Re: [OAUTH-WG] FW: [apps-discuss] APPS Area review of draft-ietf-oauth-v2-bearer-14

[Julian Reschke <[e-mail]>]

On 2011-12-12 18:28, Mike Jones wrote:
> Julian, you should reread the (substantial) mailing list threads on this topic.  As an example demonstrating the consensus, I've attached a pair of messages from a thread on this topic in which several people supported the input restriction to preclude character quoting.
>
> For instance, in this thread Eran Hammer-Lahav wrote:  "All I agree with is to limit the scope character-set in the v2 spec to the subset of ASCII allowed in HTTP header quoted-string, excluding " and \ so no escaping is needed, ever."
>
> You'll also find that all of these people then explicitly agreed with this restriction:
> John Bradley
> William Mills
> Phil Hunt
> Mike Jones
>
> I believe that there were others as well.  Therefore, it is inaccurate to characterize this consensus decision as "essentially, the two of us disagreed".

Mike,

I'm not disagreeing with the decision not to allow "\" in the value. 
What I'm disagreeing with is writing the ABNF in a way that will make it 
likely for implementers to special-case OAuth parameters when they 
should not.

The syntax of WWW-Authenticate is defined by HTTP. You *can* profile 
what senders can put into OAuth-specific parameters, but profiling what 
consumers need to parse is dangerous. Don't. Just use the generic grammar.

Best regards, Julian