Re: [OAUTH-WG] Barry Leiba's Discuss on draft-ietf-oauth-json-web-token-27: (with DISCUSS and COMMENT)

[Barry Leiba <[e-mail]>]

> At Stephen Farrell's request, I'm responding with "> " line prefixes
> on previous thread content.

Yeh, Outlook (and certain other clients, such as Lotus Notes) are
particularly bad at cooperating with the Internet-style quoting, and
it can get to be quite a mess as people with all different kinds of
mail clients start intermixing responses.  Waddyagonnado.

Maybe we oughta make a standard......

> We can update the text to clarify that MIME type comparisons
> are an exception to the "code unit by code unit" comparison rule.
> The drafts will also be scrutinized for other possible occurrences
> of exceptions to the default string comparison instructions.  Finally,
> we can add language to 7.1 about "unless otherwise noted for a
> particular kind of string" so that it's clear that there are exceptions
> to the rule.

That should work, and I'll have a look at the final result.  I'll note
that Ted Lemon (I think it was he) suggested that the documents might
leave the comparison text as is, and instead modify each place where
case-insensitive comparisons are needed by requiring that those items
be normalized to lower case (upper case would, of course, work as
well).  You might consider that, because it gets you out of the
business of trying to specify how to do the comparisons.

At some point, you might have other normalization and canonicalization
issues, though I don't see any right now.  If, for example, you might
ever have a field value containing something like "kühl", you'll have
to deal with two ways to represent the "ü" (as a single character, and
as two (a "u" plus a combining umlaut)).  It might be that that's
never going to be an issue for the JW* stuff.  But if it ever is (if
there are ever such strings that might be typed in by users), it could
be a problem.

Barry