[OAUTH-WG] Re: Mike Bishop's No Objection on draft-ietf-oauth-browser-based-apps-24: (with COMMENT)

[Mike Bishop <[e-mail]>]

Looks good — thank you!
________________________________
From: Aaron Parecki <[e-mail]>
Sent: Wednesday, May 28, 2025 12:04 PM
To: Mike Bishop <[e-mail]>
Cc: The IESG <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: Mike Bishop's No Objection on draft-ietf-oauth-browser-based-apps-24: (with COMMENT)

Thanks for your review Mike! Answers inline:


On Wed, Apr 23, 2025 at 6:44 PM Mike Bishop via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for a solid and well-written document. Definitely a pleasure to read
such a thorough analysis.

The document states, "Given the popularity of this scenario, this document uses
the term "JavaScript" to refer to all mechanisms that allow code to execute in
the application's runtime in the browser. The recommendations and
considerations in this document are not exclusively linked to the JavaScript
language or its runtime, but also apply to other languages and runtime
environments in the browser." I understand the temptation because of how we
often speak about browser code, but that seems like a recipe for confusion --
how about not doing that? Use JavaScript when you actually mean JavaScript
itself, and use "browser-based apps" when you're more general (which is most of
the time).

Please also be consistent in your usage of JavaScript versus JS. We can afford
the extra characters unless you're referring to the standard file extension.

I've done a thorough update to the language to be consistent with the terminology here. All references should now say "browser-based application" when referring to the general case, and "JavaScript" only when talking about specific JavaScript APIs.


Nit:

- Why is "The first part (Section 5.1)" not simply "Section 5.1"? Same with
second/5.2.

Thanks, fixed.

These changes are not yet posted to datatracker but you can see them on the GitHub diffs:

* https://github.com/oauth-wg/oauth-browser-based-apps/commit/f33b5f02b67de0aea697f4a45a5970e7df7d4b8f
* https://github.com/oauth-wg/oauth-browser-based-apps/commit/7d72df77b94b62a6a8141ffb4e6ae32fb6745dfd

The preview build of the doc is here:

https://drafts.oauth.net/oauth-browser-based-apps/draft-ietf-oauth-browser-based-apps.html

Thanks!

Aaron