[OAUTH-WG] Adding machine readable errors to SPOP?

Nat Sakimura <sakimura@gmail.com> Wed, 12 November 2014 20:48 UTC

Return-Path: <sakimura@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id 1BB4A1A8907 for <oauth@ietfa.amsl.com>; Wed, 12 Nov 2014 12:48:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.739
X-Spam-Status: No, score=-1.739 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id FoPHpte9CzuU for <oauth@ietfa.amsl.com>; Wed, 12 Nov 2014 12:48:54 -0800 (PST)
Received: from mail-ig0-x22c.google.com (mail-ig0-x22c.google.com [IPv6:2607:f8b0:4001:c05::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E82EE1A19E2 for <oauth@ietf.org>; Wed, 12 Nov 2014 12:48:53 -0800 (PST)
Received: by mail-ig0-f172.google.com with SMTP id a13so3743980igq.5 for <oauth@ietf.org>; Wed, 12 Nov 2014 12:48:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:from:date:message-id:subject:to:content-type; bh=thM542wy/9kBQRTq8tYViYNoh5yhJSwCV19A5Yw8plg=; b=D+vtRieiD2vLXY6Pp2UrauWxfdOhmI86V2o0COU1J73wsQJSZZSottZT2JzyYCwiim Hwqjp5/jLS09CdcfkGx/KQHBdeXtrmZ2NKvIyqNBNFK6AkUZQQgeugBUDlsYmXNcib/d 9r4IpNFWUg4ZonrsDa6XCxnk8s35U8oSoswOBzA8cYIWbeDdvk/CKGArk8J2LMDf6NAS A8PNM3KfTK1XrCDrQHLTaU3mZ+9rFZNiLnIQNP0xsZoxn7hMesPWj0OsgFElGFmfjo6p p2+b0/hzk3SBo9S1nqfjBFJuVmTpY7XNVA2RXTA9215qjzGRoUuEWzKn2vPCtrsltv1z TmDQ==
X-Received: by with SMTP id j3mr42184272igv.1.1415825333099; Wed, 12 Nov 2014 12:48:53 -0800 (PST)
MIME-Version: 1.0
From: Nat Sakimura <sakimura@gmail.com>
Date: Wed, 12 Nov 2014 20:48:51 +0000
Message-ID: <CABzCy2AqUvaJSpA3sKxWp8zs+kkTnq++Kv0a81JpBor825eaKg@mail.gmail.com>
To: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="089e0115ec100b24cb0507af86ca"
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/cT2PpHlaS-VfX8EQXMccBtTrdxU
Subject: [OAUTH-WG] Adding machine readable errors to SPOP?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Nov 2014 20:48:56 -0000

As discussed at F2F today at IETF 91 OAuth WG, there has been some request
to have a more fine grained machine readable error messages.

Currently, it only returns the error defined in RFC6749 and any more
details is supposed to be returned in error_descripton and error_uri.

So, I came up with the following proposal. If WG agrees, I would put text
embodying it into the draft-04. Otherwise, I would like to go as is. You
have to speak out to put it in. (I am sending out -03, which we meant to
send before submit freeze, without it..)

nError response to authorization request
lReturns invalid_request with additional error param spop_error with the
following values:

Clients MUST NOT accept the downgrade

request through this as it may be a downgrade

attack by a MITM.
nError response to token request
lReturns invalid_request with additional error param spop_error with the
following values:
▪invalid _code_verifier
nAuthorization server should return more descriptive information on