Subject: [OAUTH-WG] simplify authorization header?

From: Brian Eaton <[email-masked]>
Date: Sat, 10 Jul 2010 23:49:02 -0700

The current spec has the client create a "name='value'" syntax exactly
once, in the Authorization header.  We could eliminate a fair chunk of
client code by removing the name="value" syntax and going with the
approach taken by the Basic, NTLM, and Negotiate schemes:

Authorization: OAuth2 <token>

No more escaping beyond what your HTTP library provides.  Just call
setHeader("OAuth2 " + token), and you're on your merry way.

We are going to need slightly more flexibility once the signature
proposal settles down.  For that, I'd suggest using a different scheme
name.

Authorization: OAuth2Signed <self-describing-signed-token>

Cheers,
Brian

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Sun, 11 Jul 2010 13:03:31 -0700

+1 with the exception of a new scheme name for signatures. I think we need to get to a stable draft before we can figure it out. But I would like to keep the core spec open for (small) changes until we do.

I added this to -10:

Authorization: OAuth <token> [optional extension key="value" pairs]

EHL

On 7/10/10 11:49 PM, "Brian Eaton" <[email-masked]> wrote:

Cheers,
Brian
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Eaton <[email-masked]>
Date: Sun, 11 Jul 2010 14:34:04 -0700

On Sun, Jul 11, 2010 at 1:03 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> +1 with the exception of a new scheme name for signatures. I think we need
> to get to a stable draft before we can figure it out.

Very reasonable.

> But I would like to
> keep the core spec open for (small) changes until we do.
>
> I added this to -10:
>
> Authorization: OAuth <token> [optional extension key=”value” pairs]

Sure.  Hopefully we never need the key="value" stuff.