Re: [OAUTH-WG] couple minor spec issues

Eran Hammer-Lahav <eran@hueniverse.com> Mon, 15 August 2011 06:40 UTC

From: Eran Hammer-Lahav <eran@hueniverse.com>
To: OAuth WG <oauth@ietf.org>
Date: Sun, 14 Aug 2011 23:40:00 -0700
Thread-Topic: couple minor spec issues
Thread-Index: AQHMS6QtMsuj60qNLUK/U1Pu7gq3j5UAReQAgB1IzxCAAAXHYA==
Message-ID: <90C41DD21FB7C64BB94121FBBC2E7234502498CDDC@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <CA543FC3.1FDCA%clucas@e-miles.com> <CA559080.20043%clucas@e-miles.com> <90C41DD21FB7C64BB94121FBBC2E7234502498CDD8@P3PW5EX1MB01.EX1.SECURESERVER.NET>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E7234502498CDD8@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [OAUTH-WG] couple minor spec issues
Precedence: list

> On 7/26/11 9:56 AM, "Casey Lucas" <clucas@e-miles.com> wrote:

> 2. Section 6 Refreshing an Access Token seems to conflict with itself
> concerning token scope:
> 
> "The requested scope MUST be equal or lesser than the scope originally
> granted by the resource owner, and if omitted is treated as equal to the
> scope originally granted by the resource owner."
> 
> 
> Yet the last sentence in that section states:
> 
> "If a new refresh token is issued, its scope MUST be identical to that of the
> refresh token included in the request."

The identical scope is only for the refresh token, not the access token being refreshed. Clarified:

        If a new refresh token is issued, the refresh token scope MUST be identical to that of the
        refresh token included by the client in the request.

EHL

[OAUTH-WG] FW: couple minor spec issues Eran Hammer-Lahav
Re: [OAUTH-WG] couple minor spec issues Eran Hammer-Lahav