Re: [OAUTH-WG] Quick survey: fragment vs. query

Can someone pls. explain why code and token should both be returned in the fragment?

regards,
Torsten.

Am 09.08.2010 um 20:32 schrieb David Recordon <recordond@gmail.com>:

> The thread wondered a bit but Brian's summary here seems to be what most people were advocating for. Is there enough consensus to have Draft 11 reflect it?
> 
> Thanks,
> --David
> 
> 
> On Wed, Jul 14, 2010 at 10:04 AM, Brian Eaton <beaton@google.com> wrote:
> I can't parse this diagam, but here's my take:
> 
> - web server flow should always return just a code.
>   parameter always goes in the query string
>   it would be sort of reasonable to have the code exchange return
> just an access token, instead of a refresh token and an access token.
> Or a refresh token with a shorter lifetime than indefinite.
> 
> - user-agent flow can reasonably return either just a token, or a
> token and a code
>   both parameters always go in the fragment, to avoid busting the browser cache
>   same comments about lifetime of refresh tokens...
> 
> Cheers,
> Brian
> 
> On Wed, Jul 14, 2010 at 5:10 AM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:
> > Please answer this based on actual use cases. When returning parameters
> > using the redirection URI call, which of these combinations make sense?
> >
> >         | Code | Token | Code & Token
> > ---------+------+-------+--------------
> > Fragment |  a   |   1   |   3
> > Query    |  2   |   b   |   c
> > Split*   | n/a  |  n/a  |   d
> >
> > * token in fragment, code in query
> >
> > Known use cases:
> >
> > 1 - current user-agent flow
> > 2 - current web-server flow
> > 3 - as described by Brian and Naitik
> >
> > Do you need any of these?
> >
> > a -
> > b -
> > c -
> > d - current -10 code-and-token proposal
> >
> > EHL
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth
> >
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth