Re: [OAUTH-WG] Basic questions about using the HTTP Authorization header

Andrew Arnott <andrewarnott@gmail.com> Sun, 11 July 2010 05:41 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=BCx6PFAFxuwjtxCppQg3ZSL/+IHJE9Nmn6zGE9KmAv+R8MAUUD818MLn+BWiwrBKGN mhQTBVS2/PrzMbsmavsrYskaUbY+EoifauRkbCKjESZnrLXNqscmc5oMVCA8clTBAZMY GsAYPy14dQ8dLhXobptjJCikmrchtSdNHzwxs=
MIME-Version: 1.0
In-Reply-To: <012AB2B223CB3F4BB846962876F47217059B6711@SNV-EXVS08.ds.corp.yahoo.com>
References: <AANLkTilHhGQvsuvxfFF1e6zhOL7ldiqCHlrbuX47KBPV@mail.gmail.com> <012AB2B223CB3F4BB846962876F47217059B6711@SNV-EXVS08.ds.corp.yahoo.com>
Date: Sat, 10 Jul 2010 22:41:35 -0700
Message-ID: <AANLkTil3IQ7JloXmFeh_wydfAtkrhNADUhqjj_cqVOh2@mail.gmail.com>
From: Andrew Arnott <andrewarnott@gmail.com>
To: Eran Hammer-Lahav <eran@hueniverse.com>
Content-Type: multipart/alternative; boundary="00163646b7eadb8219048b161689"
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Basic questions about using the HTTP Authorization header
Precedence: list

Eran,

Is the draft 10 spec going to outline what characters are allowed in the
access token?  And if not (or if all characters are allowed), is it going to
include details about (or a reference to a doc about) how to properly escape
the access token when specifying it in the HTTP Authorization header?

Thanks.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre


On Sat, Jun 26, 2010 at 9:42 AM, William Mills <wmills@yahoo-inc.com> wrote:

>  I don't remember where I found it before, but OWS is Optional White
> Space, and RWS is Required White Space.  There is also no BNF to define
> access_token or refresh_token.
>
> For this spec to be implementable "all this stuff" has to be explicitly
> defined....
>
>
>  ------------------------------
> *From:* oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] *On Behalf
> Of *Andrew Arnott
> *Sent:* Saturday, June 26, 2010 7:03 AM
> *To:* OAuth WG (oauth@ietf.org)
> *Subject:* [OAUTH-WG] Basic questions about using the HTTP Authorization
> header
>
> Can anyone point me to good reference material for understanding the
> Authorization header in Section 5.1 of the OAuth 2.0 draft 8 spec<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header> and
> the WWW-Authenticate section 6?
>
> Specifically, some questions I have are:
>
>    1. How to properly escape the access token for inclusion in the header?
>    (suppose a linefeed or null character were in the token... how to escape
>    that?)
>    2. What do RWS and OWS stand for?
>    3. What is the "realm" value? Is the "service" string that is always
>    set as its value a literal, or a placeholder?  What are some actual values
>    that might appear?
>
> I'm sure there's an RFC out there that describes all this stuff.  RFC 2617
> is mentioned as a source for some of this, but "RWS" doesn't show up
> anywhere in that RFC, for example, so I'm not sure where the best place is
> to look this up in.
>
> Thanks.
> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death
> your right to say it." - S. G. Tallentyre
>
>

[OAUTH-WG] Basic questions about using the HTTP A… Andrew Arnott
Re: [OAUTH-WG] Basic questions about using the HT… William Mills
Re: [OAUTH-WG] Basic questions about using the HT… Andrew Arnott
Re: [OAUTH-WG] Basic questions about using the HT… Brian Eaton