Subject: [OAUTH-WG] Draft 9, Section 4.1.1 missing several parameters

From: Andrew Arnott <[email-masked]>
Date: Sat, 3 Jul 2010 14:28:34 -0700

Section 4.1.1, which deals with requesting an access token using an
authorization code, doesn't list the client_id and client_secret parameters
at all, yet mentions verifying them in paragraph form, and they are included
in the example.

--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to the death
your right to say it." - S. G. Tallentyre

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 6 Jul 2010 19:42:44 -0700

How the client authenticates itself is covered in section 2, and
client_id plus client_secret in 2.1.

The first paragraph of section 4 mentions this in a general way, but I
think an explicit pointer to section 2 would help.

Regarding the last paragraph of 4.1.1, since it explains the example,
it probably makes sense to mention client id and secret. Again, a
direct reference to 2.1 may help.

Marius

On Sat, Jul 3, 2010 at 2:28 PM, Andrew Arnott <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Justin Richer <[email-masked]>
Date: Wed, 7 Jul 2010 10:42:56 -0400

+1 on reference to section 2. Also, in 4.1.1, the wording in the last
paragraph makes it sound like the client_secret is REQUIRED for flows
using the authorization code, when as per section 2 the secret is only
required IF a secret was issued with the client_id. Wording such as
found in 4.1.2 is a better fit overall:

  The authorization server MUST validate the client credentials
  [link to Section 2 here] ...

 -- Justin