Subject: [OAUTH-WG] Authorization Header Format in draft-10

From: Michael D Adams <[email-masked]>
Date: Sun, 11 Jul 2010 19:17:10 -0700

According to section 5.1.1, commas, equal signs, and quotation marks
are all allowed in the access-token.  How do I parse the following
Authorization header?

Authorization: OAuth vF9dft4qmT,foo="bar"

1. The access-token is 'vF9dft4qmT', and the value of some extension
parameter 'foo' is 'bar'.
2. The access-token is 'vF9dft4qmT,foo="bar"'.

Am I misreading the grammar?  If not, I suggest access-token be defined as:

access-token = token / quoted-string

where token and quoted-string are taken from RFC 2616.

It would no longer be ambiguous, but it is a bit confusing since RFCs
1945, 2068, and 2616 all define quoted-string differently.  (Does that
imply transport dependent header construction/parsing?)

Alternatively, we could define CS as:

CS = RWS "," OWS

but that seems prone to implementation bugs.

Mike
--mdawaffe

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 11 Jul 2010 20:19:18 -0700

My bad. I forgot to update the ABNF for the parameters.

The right answer is 2 in the example below and the correct ABNF is:

  credentials    = "OAuth" RWS access-token RWS [ 1#auth-param ]
  access-token   = 1*( quoted-char / <"> )

  quoted-char    =   "!" / "#" / "$" / "%" / "&" / "'" / "("
                   / ")" / "*" / "+" / "-" / "." / "/" / DIGIT
                   / ":" / "<" / "=" / ">" / "?" / "@" / ALPHA
                   / "[" / "]" / "^" / "_" / "`" / "{" / "|"
                   / "}" / "~" / "\" / "," / ";"

This will be fixed in -11 (already in my github [1] copy which will continue
to change with pending -11 updates).

EHL

[1] http://github.com/theRazorBlade/draft-ietf-oauth

On 7/11/10 7:17 PM, "[email-masked]" <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: "Manger, James H" <[email-masked]>
Date: Mon, 12 Jul 2010 14:02:31 +1000

Eran,

Is then any reason to pick this collection of ASCII characters?
An access token appears in JSON, URI fragments, URI query parameters, and HTTP header values. The allowed set includes chars that need escaping in all of these. However, it is still a very limited set of 94 chars. It excludes spaces, non-ASCII Unicode etc.

This looks like the worst of all worlds. Everyone handling a token has to worry about escaping in every situation, but even that isn't enough to support arbitrary text or binary tokens. There will need to be escaping mechanisms to fit native tokens into the OAuth <access-token> production, then separate escaping to transport it.

Why not restrict <access-token> to a URI-safe alphabet (eg the 66 <unreserved> chars: A-Z a-z 0-9 - _ . ~).
If you have a binary token there is a simple approach: base64url-encode it.
If you have a text token there is a simple approach: base64url-encode its UTF-8 encoding.
If you have a little bit of structure in a token there are a couple of punctuation chars available to separate the components.

Allowing ( ) " \ = but without their usual meaning (as comments, quoting, escaping, and separating) looks certain to cause confusion.

-- 
James Manger

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Monday, 12 July 2010 1:19 PM
To: [email-masked]; OAuth WG
Subject: Re: [OAUTH-WG] Authorization Header Format in draft-10

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 11 Jul 2010 21:28:44 -0700

I basically took all the characters allowed in headers and removed white-space characters since they are used as separators. That's it. In other words, this is what HTTP requires for sending tokens in headers (which is the most consensus I was able to conclude from the list discussions). If people agree to reduce the character-set, or allow quoted string (in place or in addition) that's fine with me. As long as you can accommodate base64, I'm personally happy.

EHL

On 7/11/10 9:02 PM, "James Manger" <[email-masked]> wrote:

Eran,

--
James Manger

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Monday, 12 July 2010 1:19 PM
To: [email-masked]; OAuth WG
Subject: Re: [OAUTH-WG] Authorization Header Format in draft-10

EHL

---

From: Michael D Adams <[email-masked]>
Date: Sun, 11 Jul 2010 22:39:14 -0700

>  credentials    = "OAuth" RWS access-token RWS [ 1#auth-param ]

Thanks.  I suppose it should be

credentials    = "OAuth" RWS access-token [ RWS 1#auth-param ]

which I'll add to the sharedcopy.

Mike
--mdawaffe

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 12 Jul 2010 06:58:00 -0700

Yep. I should not write ABNF after a day of editing. 

EHL