Re: [OAUTH-WG] Issue 18: defining new response types

[Eran Hammer-Lahav <[e-mail]>]

I was only arguing against the proposed text which doesn't accomplish what you want from a normative perspective. I can easily address the use case with very short prose but I would like to see more working group discussion about it first.

Seems like WG members representing three large OAuth implementations (Facebook, Google, Microsoft) are very supportive. Does anyone objects to making the change to allow space-delimited values in the response_type parameter? Once we get consensus on that, I can proceed to offer a proposal. The main difficulty is how to deal with errors.

EHL

From: Mike Jones [mailto:[e-mail]]
Sent: Friday, July 15, 2011 10:16 AM
To: Eran Hammer-Lahav; [e-mail]
Subject: RE: Issue 18: defining new response types

Yes, that's the intent of the change

From: Eran Hammer-Lahav [mailto:[e-mail]]<mailto:[mailto:[e-mail]]>
Sent: Friday, July 15, 2011 10:14 AM
To: Mike Jones; [e-mail]<mailto:[e-mail]>
Subject: RE: Issue 18: defining new response types

You can't have it both way. Either it is a simple string comparison or it requires parsing of the string. The current prose is designed to offer a visual cue without making any code changes to how response types are compared. To allow different orders, we have to turn the value to a parsed list.

EHL

From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]]<mailto:[mailto:[e-mail]]> On Behalf Of Mike Jones
Sent: Friday, July 15, 2011 10:02 AM
To: [e-mail]<mailto:[e-mail]>
Subject: [OAUTH-WG] Issue 18: defining new response types

I agree that this functionality is needed.  However, I believe its current embodiment is overly restrictive.  I would suggest changing this text:

Only one response type of each combination may be registered and used for making requests. Composite response types are treated and compared in the same as manner as non-composite response types. The "+" notation is meant only to improve human readability and is not used for machine parsing.

For example, an extension can define and register the token+code response type. However, once registered, the same combination cannot be registered as code+token, or used to make an authorization request.
to this:

The order of the composite response type values is not significant.  For instance, the composite response types token+code and code+token are equivalent.  Each composite response type value MUST occur only once.
                                                                Thanks,
                                                                -- Mike