Re: [OAUTH-WG] Should registration request be form-urlencoded or JSON?

John Bradley <ve7jtb@ve7jtb.com> Mon, 04 February 2013 22:49 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 817D721F8B3F for <oauth@ietfa.amsl.com>; Mon, 4 Feb 2013 14:49:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.598
X-Spam-Level:
X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iFJzSpYGTL-R for <oauth@ietfa.amsl.com>; Mon, 4 Feb 2013 14:49:47 -0800 (PST)
Received: from mail-pa0-f46.google.com (mail-pa0-f46.google.com [209.85.220.46]) by ietfa.amsl.com (Postfix) with ESMTP id 71FBB21F8B47 for <oauth@ietf.org>; Mon, 4 Feb 2013 14:49:47 -0800 (PST)
Received: by mail-pa0-f46.google.com with SMTP id kp14so3611397pab.19 for <oauth@ietf.org>; Mon, 04 Feb 2013 14:49:42 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:content-type:mime-version:subject:from:in-reply-to:date :cc:message-id:references:to:x-mailer:x-gm-message-state; bh=3ntJbll0j7k5XCVBjs7Ve3x0wCfbFu2j9trADySSx7M=; b=TgX2jKsU0MPIFLuCweS1ZkhkPB2YzPLQ7JfCpyNrSKd8A0m754cg9YW5BWBX0lib2B yCDVJd2rcaEpEleqUoaAJeVGcRnlf+AGF17eLQU/tpIqz4QEITe51mNL9t8WycMWOd+k cmffD5QjlJHvK5mFQRYDaILZEySXxkvAtDwhzUmc2MeowIFjIRn/I4RgUleMc1OfZHDD d8aV8pxl7WFN7uHySKFOs9xh3Ee99qTc54peCiPkmIl+YXUs29z0r/ggzindd88+aXGq LxErYWe6NRx+QDyxLkpjXjVcQbj+h3QXkcQfS+jH7QD7/8G7fvG4rOC0mBeWzdevQ0j0 QiYg==
X-Received: by 10.66.79.135 with SMTP id j7mr33831394pax.0.1360018181890; Mon, 04 Feb 2013 14:49:41 -0800 (PST)
Received: from dhcp50-95-212-134.hil-phxpphs.phx.wayport.net (dhcp50-95-212-134.hil-phxpphs.phx.wayport.net. [50.95.212.134]) by mx.google.com with ESMTPS id az8sm24450853pab.3.2013.02.04.14.49.28 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 04 Feb 2013 14:49:32 -0800 (PST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_C49CAA19-4EE8-476A-9DA5-86B984C0287E"
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <CA+ZpN26np0h+wkv5vJeSofCpVi3cwxaiDaOj0aWn3bGuw29D0A@mail.gmail.com>
Date: Mon, 4 Feb 2013 15:49:20 -0700
Message-Id: <72121AC2-D597-4C93-9BFC-D4A4B356B9A9@ve7jtb.com>
References: <4E1F6AAD24975D4BA5B1680429673943674111BE@TK5EX14MBXC284.redmond.corp.microsoft.com> <B33BFB58CCC8BE4998958016839DE27E068866A0@IMCMBX01.MITRE.ORG> <4E1F6AAD24975D4BA5B168042967394367411337@TK5EX14MBXC284.redmond.corp.microsoft.com> <CA+ZpN26np0h+wkv5vJeSofCpVi3cwxaiDaOj0aWn3bGuw29D0A@mail.gmail.com>
To: Tim Bray <twbray@google.com>
X-Mailer: Apple Mail (2.1499)
X-Gm-Message-State: ALoCoQnZJzvC8M+DDbPo/LPnpjlyUY6edS7kaOSR6fG4G/OFJXOH8MrVYbZiVU3/Y8ZhW8n6SA1O
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Should registration request be form-urlencoded or JSON?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Feb 2013 22:49:48 -0000

For debugging JSON is cleaner than form encoded.  I hate faking arrays with space separated list (yes like scopes).

It is the way it is to be consistent with OAuth.

I think that should be a separate issue from url templates etc.

John 

On 2013-02-04, at 2:51 PM, Tim Bray <twbray@google.com> wrote:

> From the point of view of developer experience, meh, the degree of difficulty of generating/parsing JSON & form/url is about the same.
> 
> JSON has the advantage that it forces you to use UTF-8, and is more pleasant to debug when things get weird.
> 
> For my money, anything that forces anyone to use UTF-8 is A Good Thing.  -T
> 
> On Mon, Feb 4, 2013 at 1:46 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
> I’m not proposing that we boil the ocean.  “Diving in with both feet and define a full RESTful API with all appropriate verbs and CRUD ops” is an almost sure way to build a complicated spec, most of which isn’t needed, and to have it take a long time.
> 
>  
> 
> Everything in the current OpenID Registration spec is motivated by an actual use case.  Stuff that isn’t isn’t in the spec.  That’s nearly true of the closely-related OAuth Registration spec, with what I believe to be a few exceptions.  (Yes, we should harmonize those differences – hopefully based upon real use cases.)
> 
>  
> 
> I was only proposing that we answer the single question of whether we’re using the right input format or not.  I hope we can keep the discussion to that topic and not use it to generate a passel of new work items as a side effect.
> 
>  
> 
>                                                                 -- Mike
> 
>  
> 
> From: Richer, Justin P. [mailto:jricher@mitre.org] 
> Sent: Monday, February 04, 2013 1:34 PM
> To: Mike Jones
> Cc: oauth@ietf.org
> Subject: Re: [OAUTH-WG] Should registration request be form-urlencoded or JSON?
> 
>  
> 
> For history, the original UMA registration spec from whence this all grew was JSON-in and JSON-out. It's feeling like this is coming back around.
> 
>  
> 
> Pro:
> 
>  - more REST-ish (particularly if we use real REST style like URL templates and verbs)
> 
>  - consistent data structures
> 
>  - possible use of rich client data structures like lists and sub-objects
> 
>  
> 
> Con:
> 
>  - unlike the rest of OAuth, which is form-in, JSON-out
> 
>  - major change from existing code
> 
>  - possible overhead for existing OAuth libraries which haven't had to deal with JSON from clients
> 
>  
> 
>  
> 
>  
> 
> If we're going to do this, we should dive in with both feet and define a full RESTful API with all appropriate verbs and CRUD ops, and define it at the OAuth DynReg level as well.
> 
>  
> 
>  
> 
> -- Justin
> 
>  
> 
> On Feb 4, 2013, at 4:25 PM, Mike Jones <Michael.Jones@microsoft.com>
> 
>  wrote:
> 
> 
> 
> 
> Now that we're returning the registration state as JSON, it's pretty inconsistent for the registration request to instead be form-url-encoded. The case can be made for switching to JSON now - especially in light of possibly wanting to convey some structured information at registration time.
> 
> I realize that this is a big change, but if we're going to do it, we should do it now.
> 
> As a precedent, apparently SCIM requests are JSON, rather than form-url-encoded.
> 
>  
> 
>                                                                 -- Mike
> 
>  
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
> 
>  
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth