Re: [OAUTH-WG] Authorization Code Grant diagram Improvement OAuth 2.1 draft-ietf-oauth-v2-1

[Warren Parad <[e-mail]>]

Wow only now I understand that, I didn't notice the hats on the arrows, and
I was further confused why (B) had two "out arrows". Would still recommend
these being 1a and 1b, 2a/b, 3a/b.

Warren Parad

Founder, CTO
Secure your user data and complete your authorization architecture.
Implement Authress <https://bit.ly/37SSO1p>.


On Thu, Jul 30, 2020 at 7:24 PM Dick Hardt <[e-mail]> wrote:

> The (A), (B), and (C) label the same flow that bounces through the
> User-Agent. See note below the diagram.
>
> Note the tails and arrows at each end of (A) and (C), and the arrows at
> both ends of (B) to indicate an interaction between the RO and the AS. (in
> my original version, I had the User instead of the RO).
>
> The (A) and (C) flows are shown to go through the User-Agent to make it
> clear it is a redirect flow in contrast to (D) and (E) in which the Client
> directly talks to the AS.
>
>
> ᐧ
>
> On Thu, Jul 30, 2020 at 9:57 AM Warren Parad <[e-mail]> wrote:
>
>> From the OAuth RFC, these were actually letters. I don't see a necessary
>> association between the left side of the diagram and the right side, it
>> just seems unnecessarily confusing.
>> [image: image.png]
>>
>> Warren Parad
>>
>> Founder, CTO
>> Secure your user data and complete your authorization architecture.
>> Implement Authress <https://bit.ly/37SSO1p>.
>>
>>
>> On Thu, Jul 30, 2020 at 5:49 PM Aaron Parecki <[e-mail]> wrote:
>>
>>> These numbers in the diagram correspond to the numbered steps in the
>>> paragraphs below the diagram. Perhaps using non-duplicated numbers would
>>> help, such as "1a" and "1b" instead of two instances of "1"? Although I'm
>>> not sure how that would work exactly because the "1/2/3" are really just a
>>> single action as described by the "Note" below the diagram in your
>>> screenshot.
>>>
>>> ---
>>> Aaron Parecki
>>> https://aaronparecki.com
>>> https://oauth2simplified.com
>>>
>>> On Thu, Jul 30, 2020 at 8:43 AM Warren Parad <[e-mail]> wrote:
>>>
>>>>
>>>> https://www.ietf.org/id/draft-ietf-oauth-v2-1-00.html#name-authorization-code-grant
>>>>
>>>> Can we avoid using (1, 2, 3) on the left side of the diagram to
>>>> describe, I'm not even sure what they are supposed to represent, not to
>>>> mention the RO in the diagram doesn't really provide value (for me)
>>>> relevant to the code grant flow. It's confusing to see these numerical
>>>> identifiers twice in the same picture. But maybe there is something hidden
>>>> in this that I'm missing, still 3a and 3b could be used to identify
>>>> different legs of the same code path.
>>>> [image: image.png]
>>>>
>>>>
>>>> *Warren Parad*
>>>> Secure your user data and complete your authorization architecture.
>>>> Implement Authress <https://bit..ly/37SSO1p>.
>>>> <https://rhosys.ch>
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>
>>> _______________________________________________
>> OAuth mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>