Subject: [OAUTH-WG] Questions regarding -09 section 3.1

From: Diogo Almeida <[email-masked]>
Date: Sat, 3 Jul 2010 12:50:14 +0100

Good afternoon,

I would like to ask the WG two questions regarding -09

1)
On section 3.1, regarding the scope parameter, it reads:

code
REQUIRED if the response type is "token" or "code-and-token", otherwise MUST NOT be included. The authorization code generated by the authorization server. The authorization code SHOULD expire shortly after it is issued. The authorization server MUST invalidate the authorization code after a single usage. The authorization code is bound to the client identifier and redirection URI.

Question: Is it a typo that the "code" parameter is REQUIRED if the response type is "token" or "code-and-token", rather than "code" or "code-and-token"?

2)
Also in section 3.1 or -09, it's stated that the Authorization Response contains the parameters: "code", "access_token", "expires_in", "scope" and "state".

Question: Would it make sense to also include an OPTIONAL "refresh_token" to make this response more in line with section 4.2. Access Token Response. Or the intention behind the decision of not returning a "refresh_token" here was to make it so that the "access_token" cannot be refreshed this way?

Best regards,
Diogo Almeida

---

From: Diogo Almeida <[email-masked]>
Date: Tue, 6 Jul 2010 09:53:34 +0100

Sorry to repost this mail to the WG. However, we're still looking for feedback on these two issues for our provider implementation.

PS: There was a typo in my first question. Where it reads: "On section 3.1, regarding the scope parameter" it should read: "On section 3.1, regarding the code parameter".

Best regards,
Diogo Almeida

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 6 Jul 2010 07:03:22 -0700

> Question: Is it a typo that the "code" parameter is REQUIRED if the response type is "token" or "code-and-token", rather than "code" or "code-and-token"?

Yes. That's a typo. 

> Question: Would it make sense to also include an OPTIONAL "refresh_token" to make this response more in line with section 4.2. Access Token Response. Or the intention behind the decision of not ret…

Refresh token is only returned when a client secret is present (or other authentication scheme). 

EHL

> Best regards,
> Diogo Almeida
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Diogo Almeida <[email-masked]>
Date: Tue, 6 Jul 2010 15:06:15 +0100

Thanks Eran,

Best regards,
Diogo Almeida