[OAUTH-WG] draft-ietf-oauth-v2-bearer-12: ABNF nits

["Manger, James H" <[e-mail]>]

The <error-desc> value should just be <quoted-string>.
The current ABNF implies you can include raw (unescaped) " and \ characters in the value (as they are chars in <VCHAR>) - but that breaks parsing.
If the intention was not to allow senders to use escapes then <error-desc-char> needs to be <%x20-%x21 / %x23-5B / %x5D-7E>. If that is the intention why not disallow escapes from <error> as well?

Section 3 "The WWW-Authenticate Response Header Field"
OLD:
error-desc      = "error_description" "=" DQUOTE *error-desc-char DQUOTE
error-desc-char = SP / VCHAR
NEW:
error-desc      = "error_description" "=" quoted-string

The note about being allowed to parse <scope> with a quoted-string parser should also apply to <error-desc> and <error-uri> as well.


Perhaps a better approach is to: defined <scope>, <error>, <error-desc>, and <error-uri> values as <quoted-string>; add text saying senders MUST NOT use quoted-string's escape mechanism (so " and \ cannot appear in the values), though receivers MAY use a standard quoted-string parser; say the <error-uri> value must match <URI-reference>; say the <scope> value is a list of space-delimited, case sensitive strings.


NEW:
  scope = "scope" "=" quoted-string
  error = "error" "=" quoted-string
  error-desc = "error_description" "=" quoted-string
  error-uri = "error_uri" "=" quoted-string

  Senders MUST NOT use the quoted-string escape mechanism for
  "scope", "error", "error_description", or "error_uri" values.
  That is, those values cannot include " or \.
  Receivers MAY use a standard quoted-string parser, and hence
  accept some values that are not allowed to be sent.

  An "error_uri" value MUST match the URI-reference rule
  from [RFC3986].

  The "scope" value is a list of space-delimited, case sensitive
  strings. ...


P.S. trivial typo: "URI-Reference" should be "URI-reference" in §1.1.

--
James Manger