Subject: [OAUTH-WG] Extension Mechanism

From: Nat Sakimura <[email-masked]>
Date: Tue, 8 Jun 2010 13:45:52 +0900

Defining an Extension Mechanism for both request and response would
generally be useful.

Some basic design principles:

- no name space through type URI: fixed registered string for extensions.
   e.g., for Open Graph, perhaps use og:variable_names OR og_variable names
    where either "og:" or "og_" is the type prefix. (I kind of prefer ":"
over "_" as
    a separator since in CGI "-" and "_" will be identical, and in PHP GPC
parameters
    "." and "_"  are identical. Also, we are using "_" in the variable names
already. )
- no cross interactions with other extensions

I think it should be added as Chapter 7 or so, which means Security
Considerations will be chapter 8.

Following is the straw-man.

7. Extension Mechanism

Additional parameters MAY be defined for any request and response.
The parameter names MUST start with a parameter prefix separated by a colon
":".

For example:

pape:max_auth_age

Each extension MUST define its own error messages and MUST return them
through
the prefixed "error" parameter.

For example:

"pape:error":"Invalid max_auth_age format."

cheers,

Nat

-- 
Nat Sakimura (=nat)
http://www.sakimura.org/en/
http://twitter.com/_nat_en

---

From: George Fletcher <[email-masked]>
Date: Tue, 08 Jun 2010 15:58:16 -0400

+1 for a defined extension mechanism

maybe I didn't understand but I would have thought the "pape:error" 
would be...

"pape:error"="Invalid max_auth_age format."

does the message itself need to be namespaced?

Thanks,
George

On 6/8/10 12:45 AM, Nat Sakimura wrote:
>     where either "og:" or "og_" is the type prefix. (I kind of prefer 
> ":" over "_" as
>     a separator since in CGI "-" and "_" will be identical, and in PHP 
> GPC parameters
>     "." and "_"  are identical. Also, we are using "_" in the variable 
> names already. )
> The parameter names MUST start with a parameter prefix separated by a 
> colon ":".
>
> For example:
>
> pape:max_auth_age
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Nat Sakimura <[email-masked]>
Date: Wed, 9 Jun 2010 09:09:49 +0900

If the error message was returned as the Form Encoding, then it would

pape%3Aerror=Invalid%20max_auth_age%20format

If it was returned as JSON, the following will be inserted into JSON.

Whether it is better to have the "error" prefixed is a good question.
We have two options:

"pape:error":"Invalid max_auth_age format." AND
"error":"pape:Invalid max_auth_age format."

I have thought of both ways, and opted to prefix it because then the
extension would have less interaction with other parts of the server
program.
In the second way, the core module has to collect all the errors from the
extensions, which is slightly harder. From the point of view of the
client, if every error is collected in the "error" variable, it has to parse
it,
and it makes it a little harder as well. That's what I thought.

On Wed, Jun 9, 2010 at 4:58 AM, George Fletcher <[email-masked]> wrote:

> maybe I didn't understand but I would have thought the "pape:error" would
> be...
>
>
> [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>