Re: [OAUTH-WG] application/x-www-form-urlencoded vs JSON (Proposal)

Having written more than one compliant JSON parser myself, it is most
certainly not "trivial", and not something that can be safely done with a
regular expression or other hacks.

That said, it's not *hard*, and that alone is no reason not to mandate JSON,
but I do want people to be clear about what mandating JSON means.  Clients
will need a fully compliant parser.  Period.  If the OAuth spec requires
JSON, then it should require it by reference to RFC 4627, not just by giving
some examples that demonstrate the curly braces.

-DeWitt

On Wed, May 5, 2010 at 11:38 AM, Torsten Lodderstedt <
torsten@lodderstedt.net> wrote:

>  Am 05.05.2010 20:01, schrieb Evan Gilbert:
>
>
>
> On Wed, May 5, 2010 at 10:59 AM, Evan Gilbert <uidude@google.com> wrote:
>
>>
>>
>>  On Wed, May 5, 2010 at 10:47 AM, Torsten Lodderstedt <
>> torsten@lodderstedt.net> wrote:
>>
>>> Even if not supported directly by the platform there are many JSON
>>> libraries available these days.
>>>
>>
>>  It's not hard to add JSON support, but it's a factor in the choice.
>>
>>
>>>
>>> http://www.json.org/ lists 3 libraries for Objective-C alone.
>>>
>>> Moreover, the JSON documents we are discussing now are simple, something
>>> like
>>>
>>>
>>> { "access_token": "SlAV32hkKG", "expires_in": "3600", "refresh_token":
>>> "8xLOxBtZp8" }
>>>
>>>  Parsing such a document is not a challenge even without library support.
>>>
>>
>> Per notes above - the client needs to do understand form encoding anyway.
>> The client needs to parse the redirect_uri and also needs to generate form
>> encoded requests.
>>
>
>  Also, for the User-Agent flow, parsing potentially untrusted JSON in
> JavaScript is difficult. The normal path of using eval() is unsafe and leads
> to XSS holes - you need to run regex matcher to verify that the JSON content
> has no executable code.
>
>
> You are right, using eval to parse JSON is dangerous and thus as far as I
> understand, the recommended way is to use a JSON parser (aka native JSON
> support)?
>
> regards,
> Torsten.
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>