I don't remember where I found it before, but OWS is Optional White
Space, and RWS is Required White Space. There is also no BNF to define
access_token or refresh_token.
For this spec to be implementable "all this stuff" has to be explicitly
defined....
________________________________
From: [email protected] [mailto:[email protected]] On
Behalf Of Andrew Arnott
Sent: Saturday, June 26, 2010 7:03 AM
To: OAuth WG ([email protected])
Subject: [OAUTH-WG] Basic questions about using the HTTP
Authorization header
Can anyone point me to good reference material for understanding
the Authorization header in Section 5.1 of the OAuth 2.0 draft 8 spec
<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header> and
the WWW-Authenticate section 6?
Specifically, some questions I have are:
1. How to properly escape the access token for inclusion in
the header? (suppose a linefeed or null character were in the token...
how to escape that?)
2. What do RWS and OWS stand for?
3. What is the "realm" value? Is the "service" string that
is always set as its value a literal, or a placeholder? What are some
actual values that might appear?
I'm sure there's an RFC out there that describes all this stuff.
RFC 2617 is mentioned as a source for some of this, but "RWS" doesn't
show up anywhere in that RFC, for example, so I'm not sure where the
best place is to look this up in.
Thanks.
--
Andrew Arnott
"I [may] not agree with what you have to say, but I'll defend to
the death your right to say it." - S. G. Tallentyre
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
