Received-SPF: pass (google.com: domain of buhake@googlemail.com designates
 10.182.14.97 as permitted sender) client-ip=10.182.14.97; 
MIME-Version: 1.0
In-Reply-To: <CAOqH_VV4uCjyz-UP9AhNoQPuesv6Z0Wbi7Zt=tz-B4qXh0efgw@mail.gmail.com>
References: <CAOqH_VV4uCjyz-UP9AhNoQPuesv6Z0Wbi7Zt=tz-B4qXh0efgw@mail.gmail.com>
From: Buhake Sindi <buhake@googlemail.com>
Date: Tue, 21 Feb 2012 17:16:23 +0200
Message-ID: <CABUp4f6TdFcPXHPYS2B7kZK_=qZ3RESWswO=rDfo_tZvYUrjQg@mail.gmail.com>
To: Peter Brindisi <peter.brindisi@gmail.com>
Content-Type: multipart/alternative; boundary=14dae93996cd068bb804b97ae653
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] error response for invalid refresh token
Precedence: list

--14dae93996cd068bb804b97ae653
Content-Type: text/plain; charset=UTF-8

Hi

invalid_grant
>

>
The provided authorization grant (e.g. authorization code,
> resource owner credentials) is invalid, expired, revoked, does
> not match the redirection URI used
>

I would think that the refresh_token is an authorization code that needs
refreshing, so this would be valid.



On 21 February 2012 15:33, Peter Brindisi <peter.brindisi@gmail.com> wrote:

> Hi all,
>
> I am currently implementing version 23 of the oauth2 spec, and I came
> across a bit of ambiguity. What is the appropriate error code for an
> invalid refresh token? I am unsure whether it should be 'invalid_grant' or
> 'invalid_request'. Neither seems 100% clear.
>
> Thanks in advance!
>
> Best,
> Peter
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>

--14dae93996cd068bb804b97ae653
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi<br><br><blockquote style=3D"margin:0pt 0pt 0pt 0.8ex;border-left:1px sol=
id rgb(204,204,204);padding-left:1ex" class=3D"gmail_quote">invalid_grant<b=
r></blockquote><blockquote style=3D"margin:0pt 0pt 0pt 0.8ex;border-left:1p=
x solid rgb(204,204,204);padding-left:1ex" class=3D"gmail_quote">

<div>=C2=A0</div></blockquote><blockquote style=3D"margin:0pt 0pt 0pt 0.8ex=
;border-left:1px solid rgb(204,204,204);padding-left:1ex" class=3D"gmail_qu=
ote">The provided authorization grant (e.g. authorization code,<br>resource=
 owner credentials) is invalid, expired, revoked, does<br>

not match the redirection URI used<br></blockquote><br>I would think that t=
he refresh_token is an authorization code that needs refreshing, so this wo=
uld be valid.<br><br><br><br><div class=3D"gmail_quote">On 21 February 2012=
 15:33, Peter Brindisi <span dir=3D"ltr">&lt;<a href=3D"mailto:peter.brindi=
si@gmail.com">peter.brindisi@gmail.com</a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Hi all,<div><br></div><div>I am currently im=
plementing version 23 of the oauth2 spec, and I came across a bit of ambigu=
ity. What is the appropriate error code for an invalid refresh token? I am =
unsure whether it should be &#39;invalid_grant&#39; or &#39;invalid_request=
&#39;. Neither seems 100% clear.</div>



<div><br></div><div>Thanks in advance!</div><div><br></div><div>Best,</div>=
<div>Peter</div>
<br>_______________________________________________<br>
OAuth mailing list<br>
<a href=3D"mailto:OAuth@ietf.org">OAuth@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/oauth" target=3D"_blank">h=
ttps://www.ietf.org/mailman/listinfo/oauth</a><br>
<br></blockquote></div><br><br>

--14dae93996cd068bb804b97ae653--