Subject: Re: [OAUTH-WG] WGLC for OAuth 2.0 Device Flow for Browserless and Input Constrained Devices

From: William Denniss <[email-masked]>
Date: Tue, 2 Jan 2018 13:07:56 -0800

On Fri, Dec 15, 2017 at 11:12 PM, Vladimir Dzhuvinov <
[email-masked]> wrote:

> On 15/12/17 00:43, William Denniss wrote:
> > On Fri, Dec 8, 2017 at 11:42 AM, Vladimir Dzhuvinov <
> [email-masked]
> >> wrote:
> >> Hi,
> >>
> >> I just got a question on Twitter about the slow_down error:
> >>
> >> https://tools.ietf.org/html/draft-ietf-oauth-device-flow-07#section-3.5
> >>
> >> The question was why slow_down is communicated via HTTP status code 400
> >> and not 429 (Too Many Requests).
> >>
> > We could, it seems to match the intent of that error code. Main reason
> it's
> > not like that so far is that 400 is the default for OAuth, I fear people
> > may not be checking for a 429. We don't strictly *need* the 429, since
> > we're returning data in machine readable format one way or another (i.e.
> > it's easy for the client to extract the "slow_down" response either way),
> > which differs from HTML over HTTP which is intended for end-user
> > consumption, making the specific status code more important.
> Yes, on a 400 clients will need to check the error JSON object anyway,
> so the "slow_down" cannot be missed. Whereas with 429 that becomes more
> likely.
>
> +1 to return "slow_down" with status 400 as it is with the other OAuth
> error codes.
>

Thanks for considering this Vladimir. To conclude this topic, it seems
there are no compelling reasons to change to the 429, and a reasonable
explanation of why it's a 400, so I think we should keep things as-is.

Rifaat: The deadline has passed on the WGLC, and I believe all comments
raised have been addressed. Can we now advance the draft?

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 2 Jan 2018 16:30:38 -0500

William,

I will start working on the write-up soon.

Regards,
 Rifaat

On Tue, Jan 2, 2018 at 4:07 PM, William Denniss <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 2 Jan 2018 21:50:32 +0000

On Jan 2, 2018, at 4:08 PM, William Denniss <[email-masked]<mailto:[email-masked]>> wrote:

On Fri, Dec 15, 2017 at 11:12 PM, Vladimir Dzhuvinov <[email-masked]<mailto:[email-masked]>> wrote:
On 15/12/17 00:43, William Denniss wrote:
> On Fri, Dec 8, 2017 at 11:42 AM, Vladimir Dzhuvinov <[email-masked]<mailto:[email-masked]>
>> wrote:
>> Hi,
>>
> We could, it seems to match the intent of that error code. Main reason it's

Thanks for considering this Vladimir. To conclude this topic, it seems there are no compelling reasons to change to the 429, and a reasonable explanation of why it's a 400, so I think we should keep things as-is.

Rifaat: The deadline has passed on the WGLC, and I believe all comments raised have been addressed. Can we now advance the draft?

No one responded to the comment I shared on 27 November.

Scott

---

From: William Denniss <[email-masked]>
Date: Tue, 2 Jan 2018 14:12:56 -0800

Hollenbeck, sorry – I just found a half-written email in my drafts, will
finish & send shortly. I don't think this will impact the draft status, as
it's not too late to add text regarding entropy recommendations if in fact
this is the outcome of that discussion.

On Tue, Jan 2, 2018 at 1:50 PM, Hollenbeck, Scott <[email-masked]>
wrote:

>
> On Jan 2, 2018, at 4:08 PM, William Denniss <[email-masked]> wrote:
>
>

---

From: William Denniss <[email-masked]>
Date: Tue, 2 Jan 2018 14:13:31 -0800

Rifaat,

Thank you!