Re: [OAUTH-WG] register prefixes as opposed to full parameter names

[Marius Scurtescu <[e-mail]>]

On Tue, Jul 6, 2010 at 11:23 AM, Eran Hammer-Lahav <[e-mail]> wrote:
> Platforms change over time. These platforms are not designed with providing
> APIs and web services in mind. They are also typically not capable of
> running over SSL (due to the self-hosted nature of most deployments). Using
> an apache rewrite rules might be hard for some developers, but it is a good
> solution when there are issues with platform limitations.

Apache rewrite will not make a difference. Apache acts as a reverse
proxy, the user agent requests a URL without query parameters and
Apache is rewriting it by adding the query parameters. For the
endpoint running behind Apache there is no change, in all cases it
sees the query parameters.

Many of these platforms can and do provide APIs. Even if in most cases
these platforms act as clients only, the problem is still there
because of redirect_uri.


> If there are actual requirements for using OAuth 2.0 with such systems, we
> should discuss these, but it would be silly for us to architect our work
> based on the limitations of random platforms.

I don't think these are random at all. MediaWiki, Drupal, WordPress,
to name a few, are major platforms.


Marius