Re: [OAUTH-WG] user-agent flow needs a rewrite

[Brian Eaton <[e-mail]>]

On Sat, Jul 10, 2010 at 9:05 PM, Eran Hammer-Lahav <[e-mail]> wrote:
> There is no user-agent flow anymore.

Yeah.  That's a bug. =(

> The request was to allow it to
> obtain both when using a web-based component together with the user-agent.

Right, this didn't use to be possible, but Brian Ellin asked for this,
and several people agreed it was a good idea.  Unfortunately when that
feature got added, it broke a bunch of other stuff:
- all of the descriptive language about the user-agent flow is inaccurate
- if anyone tries to use the verification code approach with the
user-agent flow, the user-agent flow is no longer efficient

So in the quest to add a new feature, we broke other features.  Plus
we didn't get the new feature right.  This sounds like a normal
software development project. =)

Let me know what you think of the new language I proposed.

Note that this pretty much requires that the "type" parameter return
to the authorization URL.  That's a good thing.  If authorization
servers know about the client environment, they do a better job of
meeting the client's needs.

(Also note that we tried leaving this parameter out of WRAP, and
regretted it afterwards.)

Cheers,
Brian