Subject: #334: recipient behavior for new auth parameters

From: Julian Reschke <[email-masked]>
Date: Wed, 29 Feb 2012 23:51:51 +0100

Hi there.

I recently opened (based on oauth-bearer discussions) the following ticket:

"Should we state the default behavior for extension auth-params? Is it 
"must-ignore"?

Should we recommend that new schemes establish procedures for defining 
new parameters?"

The proposed change is not to define a global default (although it would 
be nice if we could), but to remind people how define new schemes to 
think about this and to document it.

Like that:

   Definitions of new schemes ought to define the treatment of unknown
   extension parameters. In general, a "must-ignore" rule is preferable
   over "must-understand", because otherwise it will be hard to introduce
   new parameters in the presence of legacy recipients.

(<http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/334/334.diff>)

Feedback appreciated, Julian

---

From: Henrik Nordström <[email-masked]>
Date: Thu, 01 Mar 2012 00:12:00 +0100

> "Should we state the default behavior for extension auth-params? Is it 

Yes. If not the scheme can not be extended in future while keeping
compatibility with existing clients.

> Should we recommend that new schemes establish procedures for defining 

Yes, or alternatively we might want to define a auth-param namespace for
mandatory parameters.

Regards
Henrik