Subject: [OAUTH-WG] Éric Vyncke's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Wed, 05 Aug 2020 01:47:07 -0700

Éric Vyncke has entered the following ballot position for
draft-ietf-oauth-jwsreq-26: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document.

Please find below a couple of non-blocking COMMENTs.

I hope that this helps to improve the document,

Regards,

-éric

== COMMENTS ==
Should the document shepherd's write-up be updated ? It is dated October
2016... about 4 years ago.

-- Section 5.2 --
Based on the long history of this document, is the following statement "Many
phones in the market as of this writing still"  still valid ?

-- Section 5.2.1 --
Suggest to give a hint about the use of tfp.example.org (TFP is expanded only
in section 10.2).

== NITS ==

Please check the ID-NITS at
https://tools.ietf.org/idnits?url=https://tools.ietf.org/id/draft-ietf-oauth-jwsreq-26.txt

---

From: Nat Sakimura <[email-masked]>
Date: Thu, 13 Aug 2020 22:43:19 +0900

Thanks, Éric.

Reply inline:

> https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/

Yes, partly because the demand for the authorization request payload is
becoming large these days.
As we can see in the PAR draft, we are precipitating to request_uri
pattern.

> Suggest to give a hint about the use of tfp.example.org (TFP is expanded

You are right. Perhaps it may be better to give two examples, one with TFP
with one-liner explanation and another with URN that is being stored at the
authorization server.

> https://tools.ietf.org/idnits?url=https://tools.ietf.org/id/draft-ietf-oauth-jwsreq-26.txt

Thanks. Will do.

>
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Thu, 13 Aug 2020 13:44:46 +0000

Than you Nat for the quick reply and the fixes

Regards

-éric

From: Nat Sakimura <[email-masked]>
Date: Thursday, 13 August 2020 at 15:43
To: Eric Vyncke <[email-masked]>
Cc: The IESG <[email-masked]>, oauth <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] Éric Vyncke's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)

Thanks, Éric.

Reply inline:

On Wed, Aug 5, 2020 at 5:47 PM Éric Vyncke via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:
Éric Vyncke has entered the following ballot position for
draft-ietf-oauth-jwsreq-26: No Objection

Regards,

-éric

== COMMENTS ==

-- Section 5.2 --

Yes, partly because the demand for the authorization request payload is becoming large these days.
As we can see in the PAR draft, we are precipitating to request_uri pattern.

-- Section 5.2.1 --
Suggest to give a hint about the use of tfp.example.org<http://tfp.example.org> (TFP is expanded only
in section 10.2).

You are right. Perhaps it may be better to give two examples, one with TFP with one-liner explanation and another with URN that is being stored at the authorization server.

== NITS ==

Thanks. Will do.

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 14 Aug 2020 00:15:19 +0900

You are welcome.

Actually, for 5.2, I should probably replace with more modern examples
instead of old phones and old Internet Explorer.
E.g., a) a mobile app making an authorization request through a mobile
browser; b) RAR.

On Thu, Aug 13, 2020 at 10:44 PM Eric Vyncke (evyncke) <[email-masked]>
wrote:

> *From: *Nat Sakimura <[email-masked]>
> *Date: *Thursday, 13 August 2020 at 15:43
> *To: *Eric Vyncke <[email-masked]>
> *Cc: *The IESG <[email-masked]>, oauth <[email-masked]>, "
> [email-masked]" <[email-masked]>, "
> [email-masked]" <[email-masked]>
> *Subject: *Re: [OAUTH-WG] Éric Vyncke's No Objection on
> draft-ietf-oauth-jwsreq-26: (with COMMENT)
>
>
>
> Thanks, Éric.
>
>
>
> Reply inline:
>
>
>
> On Wed, Aug 5, 2020 at 5:47 PM Éric Vyncke via Datatracker <
> [email-masked]> wrote:
>