> -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf > Of Manger, James H > Sent: Wednesday, June 30, 2010 9:18 PM > To: Yaron Goland; [email protected] > Subject: Re: [OAUTH-WG] Proposal for text for section 2 > > Yaron, > > > how can you ding client assertions credentials for doing exactly what client > basic credentials do? > > I don't like client basic credentials in request bodies either. We should > ditch > that as well. I am sure I have dinged it in the past. It offers too little > benefit > for the cost of confusing APIs (& code) by mixing the content and > authentication. And you lose a well-established discovery method: a > response with WWW-Authenticate: BASIC ....
You can still do that. The client_id and client_secret parameters are nothing more than a convenient tool for the most common use case. Also, if you noticed, Basic is not the primary method and the parameters are secondary. That's as far as consensus allowed and I would like to consider this item closed. EHL _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
