I am implementing an OAuth 2 library and the format parameter does not feel right.
If a client is using a library then the response format should be totally transparent to the client. The library may have a setting if the client wants to force a format for whatever reason, but individual messages that the client builds and receives should not care about the format. I think initially the Accept header was used. All current "format" uses are in direct requests, so Accept could be used. To give a counter example, the User-Agent flow does not use "format" and it always returns form-encoded in the fragment. There where discussions to use JSON for this flow as well. Should we do that? If yes, do we need "format"? Accept does not work in this case. I don't have a good suggestions, just wondering if anyone else run into this issue. Marius _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
