Re: [OAUTH-WG] register prefixes as opposed to full parameter names

Michael D Adams <mike@automattic.com> Wed, 07 July 2010 07:57 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type; b=W4YFnue/zAThGr+MhU6vVwyAZc18g5vSIOWBB9A56DuNoYdmcg/HAuk+m0bo32hsrZ TXlNXVJXEHTskTEoGPm225DeivC0CBEvRlPkF41mXm1i2KeKj9TpdoepAOMAIddSabMc dKdkH8i8D21Zidb/fWfyPDKKiZLSxWY+keni4=
MIME-Version: 1.0
Sender: michael.d.adams@gmail.com
In-Reply-To: <AANLkTikDx54ypvWMlZXGlgXsBi3wErcs3-SxO2hYVQYW@mail.gmail.com>
References: <1278439815.2445.8.camel@localhost.localdomain> <C858C2B1.36C16%eran@hueniverse.com> <AANLkTimWZugW68Gkg_CCYZL8TUIbtaNEAlQS7cMTTSZV@mail.gmail.com> <AANLkTimsxRHsXggcEsQhgD04YgbdUlrm_rojSi_SLc-X@mail.gmail.com> <AANLkTikDx54ypvWMlZXGlgXsBi3wErcs3-SxO2hYVQYW@mail.gmail.com>
From: Michael D Adams <mike@automattic.com>
Date: Wed, 07 Jul 2010 00:57:04 -0700
Message-ID: <AANLkTinZTSR-ZIe2kZYYLVKDRkr68JEHP7vxtyOroHGa@mail.gmail.com>
To: Marius Scurtescu <mscurtescu@google.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] register prefixes as opposed to full parameter names
Precedence: list

On Tue, Jul 6, 2010 at 10:24 PM, Marius Scurtescu <mscurtescu@google.com> wrote:
> On Tue, Jul 6, 2010 at 10:18 PM, Michael D Adams <mike@automattic.com> wrote:
>> For section 6.2 (query parameters on the end-user authorization and
>> token endpoints), this should not be an issue for WordPress.
>>
>> For section 6.3 (header parameters), this should not be an issue for WordPress.
>
> This is not an issue because whatever query parameter WordPress is
> using does not collide with the core OAuth 2 parameters? Or because
> WordPress is not using query parameters?

Neither: because WordPress is extensible enough to allow for this kind
of functionality.

WordPress uses query parameters.  A WordPress plugin that enables
OAuth, though, would have to register new URL handlers with WordPress
to act as the token and end-user authorization endpoints.  Having done
so, the plugin would then have complete control over how to behave
under any query parameters, entity-body contents, or headers: core,
extension, site specific or otherwise.

As evidence, I have written such plugins for OAuth 1.0a, OAuth WRAP,
and OAuth 2.0-draft-05.

I would be surprised if the story were different for MediaWiki and
Drupal; I naively believe a similar plugin could be developed for each
of those platforms that would avoid query parameter collision.
"Naively" because I am unfamiliar with both of those platforms.

Mike
--mdawaffe

[OAUTH-WG] register prefixes as opposed to full p… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Eran Hammer-Lahav
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Eran Hammer-Lahav
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Eran Hammer-Lahav
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Justin Richer
Re: [OAUTH-WG] register prefixes as opposed to fu… Eran Hammer-Lahav
Re: [OAUTH-WG] register prefixes as opposed to fu… William Mills
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Michael D Adams
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Michael D Adams
Re: [OAUTH-WG] register prefixes as opposed to fu… Michael D Adams
Re: [OAUTH-WG] register prefixes as opposed to fu… Marius Scurtescu
Re: [OAUTH-WG] register prefixes as opposed to fu… Michael D Adams