Subject: Re: [OAUTH-WG] Basic questions about using the HTTP Authorization header

From: Andrew Arnott <[email-masked]>
Date: Sat, 10 Jul 2010 22:41:35 -0700

Eran,

Is the draft 10 spec going to outline what characters are allowed in the
access token?  And if not (or if all characters are allowed), is it going to
include details about (or a reference to a doc about) how to properly escape
the access token when specifying it in the HTTP Authorization header?

Thanks.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

On Sat, Jun 26, 2010 at 9:42 AM, William Mills <[email-masked]> wrote:

>  I don't remember where I found it before, but OWS is Optional White
> Space, and RWS is Required White Space.  There is also no BNF to define
> access_token or refresh_token.
>
> For this spec to be implementable "all this stuff" has to be explicitly
> defined....
>
>
>  ------------------------------
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Andrew Arnott
> *Sent:* Saturday, June 26, 2010 7:03 AM
> *To:* OAuth WG ([email-masked])
> *Subject:* [OAUTH-WG] Basic questions about using the HTTP Authorization
> header
>
> Can anyone point me to good reference material for understanding the
> Authorization header in Section 5.1 of the OAuth 2.0 draft 8 spec<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header> and
> the WWW-Authenticate section 6?
>
> Specifically, some questions I have are:
>
>    1. How to properly escape the access token for inclusion in the header?
>    (suppose a linefeed or null character were in the token... how to escape
>    that?)
>    2. What do RWS and OWS stand for?
>    3. What is the "realm" value? Is the "service" string that is always
>    set as its value a literal, or a placeholder?  What are some actual values
>    that might appear?
>
> I'm sure there's an RFC out there that describes all this stuff.  RFC 2617
> is mentioned as a source for some of this, but "RWS" doesn't show up
> anywhere in that RFC, for example, so I'm not sure where the best place is
> to look this up in.
>
> Thanks.
> --
> Andrew Arnott
> "I [may] not agree with what you have to say, but I'll defend to the death
> your right to say it." - S. G. Tallentyre
>
>

---

From: Brian Eaton <[email-masked]>
Date: Sat, 10 Jul 2010 23:49:48 -0700

> the access token when specifying it in the HTTP Authorization header?

Just sent a proposal to the list to drop the Authorization header
name="value" syntax completely.  We can copy what Basic/NTLM/Negotiate
have been doing instead.