Re: [OAUTH-WG] OAuth vs OAuth2 in Authorization header

There is no such thing. Since there is no discovery for 1.0, all calls are hardcoded into the client today. There is no 'trying things out'. 

EHL

On Jul 15, 2010, at 14:33, "John Kemp" <john@jkemp.net> wrote:

> On Jul 15, 2010, at 9:07 AM, Eran Hammer-Lahav wrote:
> 
>> I would like people to raise their hand and explain how this will break actual 1.0 deployments. 
> 
> What happens if a 1.0 client receives a WWW-Authenticate header from a 2.0 protected resource with the 'OAuth' mechanism specified? Might it then attempt OAuth 1 with a 2.0 token service (and thus just fail without being able to know what went wrong)? 
> 
> - johnk
> 
>> 
>> EHL
>> 
>> 
>> 
>> On Jul 15, 2010, at 1:38, Brian Eaton <beaton@google.com> wrote:
>> 
>>> Draft 10 switched from "Token" scheme in the authorization header to
>>> "OAuth".  I'd rather we didn't reuse OAuth.  'OAuth2' would be great.
>>> "Token" is ugly as sin, but is better than "OAuth".
>>> 
>>> Spec section: http://tools.ietf.org/html/draft-ietf-oauth-v2-10#page-30
>>> 
>>> The problem with reusing "OAuth" is that there are existing
>>> implementations in the wild that have special behavior implemented for
>>> OAuth authorization headers.  Since OAuth2 headers don't have the same
>>> semantics, we're going to break those implementations.  We shouldn't
>>> reuse "OAuth" for the same reasons we shouldn't reuse "Negotiate",
>>> "NTLM", "Digest", or "Basic.
>>> 
>>> Cheers,
>>> Brian
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
> 