Re: [OAUTH-WG] native app support (was: Next draft)

[Marius Scurtescu <[e-mail]>]

On Tue, Jun 22, 2010 at 4:26 PM, Eran Hammer-Lahav <[e-mail]> wrote:
> In that case, I suggest an extension. But I just don't think this needs it. Why involve the server at all in this? The client should just host a web page somewhere with the format it wants or the language for the user.
>
> With $10 hosting, every client can host a web page somewhere.

Hard to tell, you could be right. Keep in mind that this page has to
be reliable and secure, $10 will probably not give you that. An authz
server can easily provide all this at almost no cost.

Marius

>
> EHL
>
>> -----Original Message-----
>> From: Marius Scurtescu [mailto:[e-mail]]
>> Sent: Tuesday, June 22, 2010 4:17 PM
>> To: Eran Hammer-Lahav
>> Cc: OAuth WG ([e-mail])
>> Subject: Re: native app support (was: Next draft)
>>
>> On Tue, Jun 22, 2010 at 4:07 PM, Eran Hammer-Lahav
>> <[e-mail]> wrote:
>> >
>> >> -----Original Message-----
>> >> From: Marius Scurtescu [mailto:[e-mail]]
>> >> Sent: Tuesday, June 22, 2010 3:35 PM
>> >> To: Eran Hammer-Lahav
>> >> Cc: OAuth WG ([e-mail])
>> >> Subject: Re: native app support (was: Next draft)
>> >>
>> >> On Tue, Jun 22, 2010 at 3:14 PM, Eran Hammer-Lahav
>> >> <[e-mail]> wrote:
>> >> > In OAuth 1.0a, we needed it for the patch. I don't think this needs
>> >> > to be in
>> >> the spec because it doesn't help interop. If the server supports such
>> >> a scheme, it should document it. It also falls under "previously
>> >> established redirection URI" which happens to point at the server.
>> >>
>> >> OK, that makes sense.
>> >>
>> >> What about:
>> >> > Also, this page should put the verification code and the client
>> >> > state (code and state) in the page title in a standard way such
>> >> > that the native app can extract them from the window title. WRAP
>> >> > defined how the title should be formed.
>> >>
>> >> Extension?
>> >
>> > I don't think this needs a spec. Just something provided by the server. Does
>> the client need any special handling? It can always just use a static web page
>> to do this, no?
>>
>> A spec would help so all servers provide code and state in a consistent
>> format. Client libraries can then provide methods to parse this. Also, client
>> apps connecting to multiple servers can expect some consistency.
>>
>> Marius
>>
>> >
>> > EHL
>> >
>> >>
>> >> Marius
>> >>
>> >> >
>> >> > EHL
>> >> >
>> >> >> -----Original Message-----
>> >> >> From: Marius Scurtescu [mailto:[e-mail]]
>> >> >> Sent: Tuesday, June 22, 2010 1:02 PM
>> >> >> To: Eran Hammer-Lahav
>> >> >> Cc: OAuth WG ([e-mail])
>> >> >> Subject: Re: native app support (was: Next draft)
>> >> >>
>> >> >> On Tue, Jun 8, 2010 at 10:46 AM, Marius Scurtescu
>> >> >> <[e-mail]> wrote:
>> >> >> > In order to properly support native applications I suggest the
>> >> >> > following changes:
>> >> >> > [...]
>> >> >> > 2. optional redirect_uri (default result page)
>> >> >> >
>> >> >> > Some native apps do not have a redirect_uri, as a result two
>> >> >> > things are
>> >> >> needed:
>> >> >> >
>> >> >> > 2.1 Either make redirect_uri optional or define a standard value
>> >> >> > that signals that the client does not have such a page.
>> >> >> >
>> >> >> > 2.2 The authz server must supply a default result page, if there
>> >> >> > is no redirect_uri. Also, this page should put the verification
>> >> >> > code and the client state (code and state) in the page title in
>> >> >> > a standard way such that the native app can extract them from
>> >> >> > the window title. WRAP defined how the title should be formed.
>> >> >>
>> >> >> Should this also go to an extension? It is not introducing any new
>> >> >> parameters, not sure if it belongs there. OAuth 1 at least defined
>> >> >> the
>> >> "oob" special value.
>> >> >>
>> >> >> Marius
>> >> >
>> >
>