Re: [OAUTH-WG] OAuth ABNF

[Julian Reschke <[e-mail]>]

On 2012-04-23 23:19, Eran Hammer wrote:
> During the IESG review of draft-ietf-oauth-v2, Sean Turner raised the
> following DISCUSS item (meaning, the specification is blocked until this
> is resolved):
>
>  > 0) General: I found the lack of ABNF somewhat disconcerting in that
>
>  > implementers would have to hunt through the spec to figure out all the
>
>  > values of a given field. For example grant_type has different values
> based
>
>  > on the different kind of access_token requests - four to be more
> precise -
>
>  > but there's no ABNF for the field. There are many examples of
>
>  > this. It would greatly aid implementers if a) the ABNF for all fields
>
>  > were included in the draft and b) all the ABNF was collected in one
> place. I
>
>  > had individual discusses for each field that had missing ABNF, but it
> was
>
>  > getting out of hand so I'm just going to do this one general discuss
> on this
>
>  > topic.
>
> I don’t have the time to prepare such text. Can someone volunteer to
> submit this text to the WG for review?

Putting values in the ABNF makes only sense if and only of the set of 
values is hardwired, so there's no extension point. Otherwise it's 
misleading, because it will lead to fragile parser implementations.

WRT collected ABNF: this can be generated automatically, you may want to 
have a look at 
<http://trac.tools.ietf.org/wg/httpbis/trac/browser/draft-ietf-httpbis/latest/Makefile>.

Best regards, Julian