Subject: [Txauth] XYZ vs XAuth: Data Representation

From: Dick Hardt <[email-masked]>
Date: Mon, 16 Mar 2020 16:05:28 -0700

*Data Representation*
XYZ
- Protocol is centered around a transaction (akin to OAuth “grant”)
- uses a single URL for interactions around transaction
- handles represent the transaction for continuity between requests

XYZ Rationale: the OAuth 2 “grant” is a concept that doesn’t have clear
reification in the OAuth world, the “transaction” raises it to that level
and allows us to reason on it. Single URI model is simple for clients with
a limited set of actions, but multiple URIs could be dispatched from this
as in XAuth without breaking the mental model (just like interaction and
code URLs are now).

XAuth
- protocol is RESTful (GET, PATCH, POST, PUT, DELETE, OPTIONS)
- GS URI is identifier for GS, and is URI to create Grants
- URIs represent Grants and Authorizations with associated access tokens
(and any other objects such as Sessions created later)

XAuth Rationale  URI model provides "identifier" and URL. HTTP verbs are
used to manipulate. Easy to determine GS for a Grant or Authorization.
Contents of URI are opaque allowing an implementation to easily map to
implementation requirements.
ᐧ