Re: [OAUTH-WG] Rename callback => callback_uri

[Evan Gilbert <[e-mail]>]

On Fri, Apr 16, 2010 at 1:45 PM, Eran Hammer-Lahav <[e-mail]>wrote:

>  We should use the right term, not just the less conflicting term.
>
> The Web Callback flow uses a callback from the server to the client – this
> is not a redirection. The User-Agent flow uses a redirection which is
> fundamentally different from a callback.
>


   callback
         An absolute URI to which the authorization server will redirect
         the end user back when the end user authorization step is
         completed.  The authorization server MAY require the client to
         pre-register their callback URI.


   redirection
         An absolute URI to which the authorization server will redirect
         the user-agent to when the end user authorization step is
         completed.  The authorization server SHOULD require the client
         to pre-register their redirection URI.

These look the same to me, and "redirect_uri/url" works. Open to other
terms.



> If you don’t want to use callback and want to use the same name for both,
> it needs to be something more generic like client_uri.
>
> EHL
>
>
> On 4/16/10 12:11 PM, "Naitik Shah" <[e-mail]> wrote:
>
> +1 for redirect_uri -- highest semantic value imho.
>
>
> -Naitik
>
>
>
> On Apr 16, 2010, at 12:05 PM, Evan Gilbert wrote:
>
> > We should use the same name in the User-Agent and Web Callback flows.
> Also, although the authorization server won't be allowing JSONP requests,
> "callback" has become a bit of a defacto standard for JSONP and it would be
> nice to use a term that isn't overloaded?
> >
> > Can we make them both "redirection"? Even better, maybe "redirect_uri"?
> >
> > On Fri, Apr 16, 2010 at 9:50 AM, Luke Shepard <[e-mail]>
> wrote:
> > Facebook API requests are protected resources. They can be called either
> in a browser or in a server-to-server environment.
> >
> > For example, a JSONP call for my name looks like this:
> >
> >
> https://api.facebook.com/restserver.php?api_key=361900759629&call_id=1271436355034&callback=FB.RestServer._callback&format=json&method=fql.query&query=SELECT%20name%20FROM%20user%20WHERE%20uid%3D2901279&v=1.0
> >
> > The output (you can play with it here:
> http://fbrell.com/fb.api/everyone-data ):
> >
> >        FB.RestServer._callback([{"name":"Luke Shepard"}]);
> >
> > If we want that protected resource to take an access token as well, then
> it would look like:
> >
> >
> https://api.facebook.com/restserver.php?....&callback=FB.RestServer._callback&access_token=ACCESS_TOKEN
> >
> > The "callback" parameter is used pretty universally for JSONP requests.
> For instance, see the Jquery docs: http://api.jquery.com/jQuery.getJSON/
> >
> > -----Original Message-----
> > From: Richard Barnes [mailto:[e-mail] <[e-mail]>]
> > Sent: Friday, April 16, 2010 9:10 AM
> > To: Luke Shepard
> > Cc: Eran Hammer-Lahav; Naitik Shah; OAuth WG
> > Subject: Re: [OAUTH-WG] Rename callback => callback_uri
> >
> > Could you clarify a little more the environment in which this
> > confusion arose?  What do you mean when you say "The protected
> > resource typically accepts 'callback' as a parameter to support
> > JSONP."?  What sort of software are you including in this?
> >
> > --Richard
> >
> >
> > On Apr 15, 2010, at 5:41 PM, Luke Shepard wrote:
> >
> > > We already had one developer try it out and get confused because the
> > > server tried to treat the callback URL as a JSONP callback.
> > >
> > > The protected resource typically accepts "callback" as a parameter
> > > to support JSONP. If a developer accidentally passes in callback
> > > there (maybe they got confused) then the server can't give a normal
> > > error message - instead it needs to either detect that it looks like
> > > a URL or otherwise reject it.
> > >
> > > On a related note, I think it's more confusing calling it something
> > > different in the user-agent flow (redirector) when it's essentially
> > > doing the same thing.
> > >
> > >
> > > From: [e-mail] [mailto:[e-mail]<[e-mail]>]
> On
> > > Behalf Of Eran Hammer-Lahav
> > > Sent: Thursday, April 15, 2010 5:37 AM
> > > To: Naitik Shah; OAuth WG
> > > Subject: Re: [OAUTH-WG] Rename callback => callback_uri
> > >
> > > I don't think it is that confusing. Its a completely different
> > > context from where JSON-P is used (note that in the User-Agent flow
> > > it is called something else).
> > >
> > > EHL
> > >
> > >
> > > On 4/10/10 12:35 PM, "Naitik Shah" <[e-mail]> wrote:
> > >
> > > With the simplified params, the callback url parameter is now just
> > > "callback". Since most major API providers already use "callback" to
> > > signify JSON-P callback, can we rename this to "callback_uri"? This
> > > will help avoid collisions and confusion.
> > >
> > >
> > > -Naitik
> > > _______________________________________________
> > > OAuth mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/oauth
> > >
> > > _______________________________________________
> > > OAuth mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/oauth
> >
> > _______________________________________________
> > OAuth mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/oauth
> >
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>