+1 on reference to section 2. Also, in 4.1.1, the wording in the last paragraph makes it sound like the client_secret is REQUIRED for flows using the authorization code, when as per section 2 the secret is only required IF a secret was issued with the client_id. Wording such as found in 4.1.2 is a better fit overall:
The authorization server MUST validate the client credentials [link to Section 2 here] ... -- Justin On Tue, 2010-07-06 at 22:42 -0400, Marius Scurtescu wrote: > How the client authenticates itself is covered in section 2, and > client_id plus client_secret in 2.1. > > The first paragraph of section 4 mentions this in a general way, but I > think an explicit pointer to section 2 would help. > > Regarding the last paragraph of 4.1.1, since it explains the example, > it probably makes sense to mention client id and secret. Again, a > direct reference to 2.1 may help. > > Marius > > > > On Sat, Jul 3, 2010 at 2:28 PM, Andrew Arnott <[email protected]> wrote: > > Section 4.1.1, which deals with requesting an access token using an > > authorization code, doesn't list the client_id and client_secret parameters > > at all, yet mentions verifying them in paragraph form, and they are included > > in the example. > > -- > > Andrew Arnott > > "I [may] not agree with what you have to say, but I'll defend to the death > > your right to say it." - S. G. Tallentyre > > > > _______________________________________________ > > OAuth mailing list > > [email protected] > > https://www.ietf.org/mailman/listinfo/oauth > > > > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
