Re: [OAUTH-WG] Clarification on whether arguments can contain empty values

[Eran Hammer-Lahav <[e-mail]>]

The best way to address this is to write more resilient servers. Servers should accept empty optional parameters.

EHL

From: [e-mail] [mailto:[e-mail]] On Behalf Of Andrew Arnott
Sent: Tuesday, June 15, 2010 6:56 AM
To: OAuth WG ([e-mail])
Subject: [OAUTH-WG] Clarification on whether arguments can contain empty values

Can we get some clarification into the spec as to whether optional parameters can be present but empty?  Particularly parameters such as tokens that obviously cannot be meaningful when having an empty value.  This was a muddy issue in the OpenID spec, where some implementations would include empty parameters rather than just omitting them, breaking other implementations that would expect that if the parameter is present it ought to have a meaningful value.

My own vote: parameters must have valid values (non-empty) if they are present, unless they are opaque strings (like client state) that the remote party doesn't have to do anything but imitate back anyway.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre