Re: [OAUTH-WG] application/x-www-form-urlencoded vs JSON (Proposal)

Greg Brail <gbrail@sonoasystems.com> Fri, 07 May 2010 18:30 UTC

Return-Path: <gbrail@sonoasystems.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A40173A68C2 for <oauth@core3.amsl.com>; Fri, 7 May 2010 11:30:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.073
X-Spam-Level:
X-Spam-Status: No, score=-0.073 tagged_above=-999 required=5 tests=[AWL=-0.697, BAYES_50=0.001, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OjTIgN1zMmu0 for <oauth@core3.amsl.com>; Fri, 7 May 2010 11:30:19 -0700 (PDT)
Received: from mail-qy0-f181.google.com (mail-qy0-f181.google.com [209.85.221.181]) by core3.amsl.com (Postfix) with ESMTP id 1E2733A690A for <oauth@ietf.org>; Fri, 7 May 2010 11:30:08 -0700 (PDT)
Received: by qyk11 with SMTP id 11so1967985qyk.13 for <oauth@ietf.org>; Fri, 07 May 2010 11:29:52 -0700 (PDT)
Received: by 10.224.72.143 with SMTP id m15mr196621qaj.231.1273256985971; Fri, 07 May 2010 11:29:45 -0700 (PDT)
From: Greg Brail <gbrail@sonoasystems.com>
References: <9890332F-E759-4E63-96FE-DB3071194D84@gmail.com> <20100430105935.20255m8kdythy6sc@webmail.df.eu> <90C41DD21FB7C64BB94121FBBC2E723439323D0DB0@P3PW5EX1MB01.EX1.SECURESERVER.NET> <AANLkTik3NSJynWfiNWovruPEOT2Y6G1zcWPFOaS_pHdy@mail.gmail.com> <4BE1AF25.7000308@lodderstedt.net> <AANLkTil2_9KOm1eRoC0jxvH99E55K3BEW-T5cgWLay9H@mail.gmail.com> <AANLkTilWV3VVBROXZuky5OLNzM2hz27pEqwG1l6W2Uc1@mail.gmail.com> <4BE1BB10.7060009@lodderstedt.net> <w2v77facc501005051149pca35de47tfcca515a3b557c81@mail.gmail.com> <4BE1F2A1.9040707@pidster.com> <s2mc334d54e1005060846k10f446b4r5f907acf237f8735@mail.gmail.com> <01bb1f595f89af50b0c37c00dbcd54cd@mail.gmail.com> <E9F67F8B-DF87-40D5-8BCF-F9113D14BD77@facebook.com>
In-Reply-To: <E9F67F8B-DF87-40D5-8BCF-F9113D14BD77@facebook.com>
MIME-Version: 1.0
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcrtqOE4Oq2YZM9aR+2qWUdIZTCltwAaXVJQ
Date: Fri, 07 May 2010 14:29:44 -0400
Message-ID: <10577de84bc497dea170055097bc0086@mail.gmail.com>
To: oauth@ietf.org
Content-Type: multipart/alternative; boundary="00c09f88cfaf5bd08f0486053ea9"
Subject: Re: [OAUTH-WG] application/x-www-form-urlencoded vs JSON (Proposal)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 May 2010 18:30:20 -0000

JSONObject is fine. I imagine that any development organization could use it
in their project as long as their legal staff is willing to forgo the option
of doing Evil. (That's what the license says ;-)



My point is that pulling in *any* third party code is always a bigger
barrier to adoption to using something that's already built in to the
environment and has been for many years, so it even works in organizations
that have not yet adopted the latest releases of things. (With that said,
having JSON support in Python 2.6 is a good thing and it's too bad that the
Java platform is moving so slowly these days.)



As others have said more eloquently, if need to ever support non-string data
types, arrays, or nested structures, then JSON is the best choice, over XML
or something hand-rolled. But if the need is to just handle a short list of
single name-value pairs, then using form-urlencoded, to me, is the simplest
choice that places the fewest barriers in front of developers on all
platforms.



*From:* Luke Shepard [mailto:lshepard@facebook.com]
*Sent:* Friday, May 07, 2010 1:48 AM
*To:* Greg Brail
*Cc:* oauth@ietf.org
*Subject:* Re: [OAUTH-WG] application/x-www-form-urlencoded vs JSON
(Proposal)





On May 6, 2010, at 9:13 AM, Greg Brail wrote:



  I agree that JSON is the long-term winner. However, at least for Java and
Python I know that JSON parsers are not part of the standard library,
whereas everything needed to decode a url-formencoded library is in the
standard libraries and has been there for a long, long time. Keep in mind
that the overhead of using third-party code is not just in finding and using
the right library, but getting legal clearance if it's open source and you
work for a big company.



Python includes a JSON parser in Python 2.6:
http://docs.python.org/library/json.html



Java has JSONObject available. Are there cases where it would be difficult
to use a library like this?