[OAUTH-WG] [Technical Errata Reported] RFC8252 (8080)

RFC Errata System <rfc-editor@rfc-editor.org> Fri, 16 August 2024 23:58 UTC

To: rfc8252@wdenniss.com, rfc8252@ve7jtb.com, debcooley1@gmail.com, paul.wouters@aiven.io, hannes.tschofenig@arm.com, rifaat.s.ietf@gmail.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240816235803.C39593B874@rfcpa.rfc-editor.org>
Date: Fri, 16 Aug 2024 16:58:03 -0700
Message-ID-Hash: GQVHT2EJAWVF5OM6HBHPNBH7PPZD5ERY
CC: bryce.m.thomas@gmail.com, oauth@ietf.org, rfc-editor@rfc-editor.org
Precedence: list
Subject: [OAUTH-WG] [Technical Errata Reported] RFC8252 (8080)
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/rwMPNgc1StVXTaW-iuTuk3flkco>

The following errata report has been submitted for RFC8252,
"OAuth 2.0 for Native Apps".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8080

--------------------------------------
Type: Technical
Reported by: Bryce Thomas <bryce.m.thomas@gmail.com>

Section: 6 and 7.1

Original Text
-------------
> Any redirect URI that allows
   the app to receive the URI and inspect its parameters is viable.

and

> When choosing a URI scheme to associate with the app, apps MUST use a
   URI scheme based on a domain name under their control, expressed in
   reverse order, as recommended by Section 3.8 of [RFC7595] for
   private-use URI schemes.

These two statements appear to conflict.

Corrected Text
--------------
> Any redirect URI that allows
   the app to receive the URI and inspect its parameters is viable.

and

> When choosing a URI scheme to associate with the app, apps SHOULD use a
   URI scheme based on a domain name under their control, expressed in
   reverse order, as recommended by Section 3.8 of [RFC7595] for

Notes
-----
Suggest downgrading the section 7.1 text from MUST to SHOULD to resolve the conflict.

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it 
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8252 (draft-ietf-oauth-native-apps-12)
--------------------------------------
Title               : OAuth 2.0 for Native Apps
Publication Date    : October 2017
Author(s)           : W. Denniss, J. Bradley
Category            : BEST CURRENT PRACTICE
Source              : Web Authorization Protocol
Stream              : IETF
Verifying Party     : IESG

[OAUTH-WG] [Technical Errata Reported] RFC8252 (8… RFC Errata System
[OAUTH-WG] Re: [Technical Errata Reported] RFC825… Aaron Parecki