Re: [OAUTH-WG] Open Issues: Group Survey (respond by 5/13)

[Vivek Khurana <[e-mail]>]

On Mon, May 10, 2010 at 2:36 AM, Eran Hammer-Lahav <[e-mail]> wrote:
> DEADLINE: 5/13
>
> I would like to publish one more draft before our interim meeting in two weeks (5/20). Below are two open issues we have on the list. Please reply with your preference (or additional solutions) to each item. Issues with consensus will be incorporated into the next draft. Those without will be discussed at the meeting.
>
> EHL
>
> ---
>
> 1. Server Response Format
>
> After extensive debate, we have a large group in favor of using JSON as the only response format (current draft). We also have a smaller group but with stronger feelings on the subject that JSON adds complexity with no obvious value.
>
> A. Form-encoded only (original draft)
> B. JSON only (current draft)
> C. JSON as default with form-encoded and XML available with an optional request parameter

 Being someone who has been involved in development of general purpose
libraries, I will either A or B, which means either full JSON RFC 4267
compliance or Form-encoded only. Support of multiple format not only
increases development and maintenance effort, it increases the size of
library too. Since on the web, client might have to download the
library, keeping library size small is very important. If the standard
supports multiple formats, we might end up with libraries which will
support either JSON or XML or Form-encoded, thus leading to confusion
among developers.

>
> ---
>
> 2. Client Authentication (in flows)
>
> How should the client authenticate when making token requests? The current draft defines special request parameters for sending client credentials. Some have argued that this is not the correct way, and that the client should be using existing HTTP authentication schemes to accomplish that such as Basic.
>
> A. Client authenticates by sending its credentials using special parameters (current draft)
> B. Client authenticated by using HTTP Basic (or other schemes supported by the server such as Digest)

 Either of them is acceptable, but if we go with B, the specification
should specify the charset to be used for Basic authentication.

regards
Vivek

-- 
The hidden harmony is better than the obvious!!