Re: [OAUTH-WG] Draft 9, Section 4.1.1 missing several parameters

+1 on reference to section 2. Also, in 4.1.1, the wording in the last
paragraph makes it sound like the client_secret is REQUIRED for flows
using the authorization code, when as per section 2 the secret is only
required IF a secret was issued with the client_id. Wording such as
found in 4.1.2 is a better fit overall:

  The authorization server MUST validate the client credentials
  [link to Section 2 here] ...

 -- Justin

On Tue, 2010-07-06 at 22:42 -0400, Marius Scurtescu wrote:
> How the client authenticates itself is covered in section 2, and
> client_id plus client_secret in 2.1.
> 
> The first paragraph of section 4 mentions this in a general way, but I
> think an explicit pointer to section 2 would help.
> 
> Regarding the last paragraph of 4.1.1, since it explains the example,
> it probably makes sense to mention client id and secret. Again, a
> direct reference to 2.1 may help.
> 
> Marius
> 
> 
> 
> On Sat, Jul 3, 2010 at 2:28 PM, Andrew Arnott <andrewarnott@gmail.com> wrote:
> > Section 4.1.1, which deals with requesting an access token using an
> > authorization code, doesn't list the client_id and client_secret parameters
> > at all, yet mentions verifying them in paragraph form, and they are included
> > in the example.
> > --
> > Andrew Arnott
> > "I [may] not agree with what you have to say, but I'll defend to the death
> > your right to say it." - S. G. Tallentyre
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth
> >
> >
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth