For section 6.2, and possibly 6.3, I would suggest to register a
prefix for all the parameters defined by an extension.
Pros:
1. Simpler registration, only one element needs to be registered, the
prefix, and not every single parameter name. Once an extension has a
prefix registered it can evolve and change the parameters it is using
much easier.
2. Greatly reduce the chances of a conflict with a query parameter
used by an authz server endpoint or client redirect_uri.
3. Consistent with the generic vendor specific extension space ("x_").
4. Allows strict validation of OAuth parameters. Unknown extensions
will be ignored, but the known ones can be strictly validated.
5. Easy to determine what parameter is core and what is part of an extension.
Cons:
1. Slightly longer parameter names.
Underscore or dot could be used to separate the prefix from the name.
Marius
_______________________________________________
OAuth mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/oauth
