Re: [oauth] OAUTH Charter Proposal

On Mon, Feb 2, 2009 at 4:15 PM, Eran Hammer-Lahav <eran@hueniverse.com> wrote:
> How is exchanging credentials equal to authentication?

By exchanging the credentials in a verifiable way (i.e., with secrets
& signing), you're authenticating the consumer as acting on behalf of
the user. If we weren't trying to do *authenticated* requests, then
there wouldn't be any point in hiding (or having) secrets.

> I would not want to use the term API in the charter. While this is the current use case, I view OAuth as part of the 2617 family, and can be used for any HTTP request. I do not think most people consider every HTTP request an API call.

+1 - perhaps the more general "Interface" makes sense? I think OAuth
is actually a bit more general than 2617, in that it's possible to use
it across transport protocols (though in general we should be
targeting HTTP first).

b.
_______________________________________________
oauth mailing list
oauth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth