Subject: [OAUTH-WG] Comment on 'application/x-www-form-urlencoded' for URI parameters

From: Subbu Allamaraju <[email-masked]>
Date: Wed, 1 Dec 2010 14:05:24 -0800

Here is some feedback on the use of the 'application/x-www-form-urlencoded' media type in the latest drafts (10 or 11).

The draft refers to the 'application/x-www-form-urlencoded' media type for encoding parameters into the query component of URIs. For instance, see 4.1 in draft 11 has

"In order to direct the end-user's user-agent to the authorization
   server, the client constructs the request URI by adding the following
   parameters to the end-user authorization endpoint URI query component
   using the "application/x-www-form-urlencoded" format as defined by
   [W3C.REC-html401-19991224]"

However, this media type specifies how to encode parameters in the body of a representation but not in URIs. In fact use of this encoding for characters like spaces will break URIs. 

Subbu

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 1 Dec 2010 15:16:49 -0700

The latest reference is:

http://www.w3.org/TR/html5/association-of-controls-and-forms.html#application-x-www-form-urlencoded-encoding-algorithm

But that's still a draft.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Subbu Allamaraju
> Sent: Wednesday, December 01, 2010 2:05 PM
> To: OAuth WG
> Subject: [OAUTH-WG] Comment on 'application/x-www-form-urlencoded'
> for URI parameters
> 
> Here is some feedback on the use of the 'application/x-www-form-
> urlencoded' media type in the latest drafts (10 or 11).
> 
> The draft refers to the 'application/x-www-form-urlencoded' media type for
> encoding parameters into the query component of URIs. For instance, see
> 4.1 in draft 11 has
> 
> However, this media type specifies how to encode parameters in the body of
> a representation but not in URIs. In fact use of this encoding for characters
> like spaces will break URIs.
> 
> Subbu
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Subbu Allamaraju <[email-masked]>
Date: Thu, 2 Dec 2010 11:20:37 -0800

Eran - but that does change anything. That HTML4/HTML5 media type does not specify how to encode parameters into query portion of URIs. I'm not aware of any RFC that describes this name=value pair encoding. So, OAuth draft needs to specify how a client needs to manipulate auth/resource server's URIs to add protocol-specific parameters.

Subbu

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 2 Dec 2010 12:26:06 -0700

Using form-encoding to encode the URI query is well established and directly based on the media type rules. No further specification is needed.

EHL

> From: Subbu Allamaraju [mailto:[email-masked]]
> Sent: Thursday, December 02, 2010 11:21 AM
> To: Eran Hammer-Lahav
> Cc: OAuth WG
> Subject: Re: [OAUTH-WG] Comment on 'application/x-www-form-
> urlencoded' for URI parameters
> 
> Eran - but that does change anything. That HTML4/HTML5 media type does
> not specify how to encode parameters into query portion of URIs. I'm not
> aware of any RFC that describes this name=value pair encoding. So, OAuth
> draft needs to specify how a client needs to manipulate auth/resource
> server's URIs to add protocol-specific parameters.
> 
> Subbu
> 
> > http://www.w3.org/TR/html5/association-of-controls-and-
> forms.html#appl
> > ication-x-www-form-urlencoded-encoding-algorithm
> >
> >> From: [email-masked] [mailto:[email-masked]] On
> >> Behalf Of Subbu Allamaraju
> >> The draft refers to the 'application/x-www-form-urlencoded' media
> >> type for encoding parameters into the query component of URIs. For
> >> instance, see
> >> 4.1 in draft 11 has
> >>
> >> However, this media type specifies how to encode parameters in the
> >> body of a representation but not in URIs. In fact use of this
> >> encoding for characters like spaces will break URIs.
> >>
> >> Subbu

---

From: Subbu Allamaraju <[email-masked]>
Date: Sun, 19 Dec 2010 15:39:53 -0800

This is a minor point, but for a spec, it is better to be precise than rely on conventions. The spec should at least say where it differs from the application/x-www-form-urlencoded encoding algorithm (such as using UTF-8 encoding for all octets including 0x20). 

My 2 cents.

Subbu