Eran, Is the draft 10 spec going to outline what characters are allowed in the access token? And if not (or if all characters are allowed), is it going to include details about (or a reference to a doc about) how to properly escape the access token when specifying it in the HTTP Authorization header?
Thanks. -- Andrew Arnott "I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - S. G. Tallentyre On Sat, Jun 26, 2010 at 9:42 AM, William Mills <[email protected]> wrote: > I don't remember where I found it before, but OWS is Optional White > Space, and RWS is Required White Space. There is also no BNF to define > access_token or refresh_token. > > For this spec to be implementable "all this stuff" has to be explicitly > defined.... > > > ------------------------------ > *From:* [email protected] [mailto:[email protected]] *On Behalf > Of *Andrew Arnott > *Sent:* Saturday, June 26, 2010 7:03 AM > *To:* OAuth WG ([email protected]) > *Subject:* [OAUTH-WG] Basic questions about using the HTTP Authorization > header > > Can anyone point me to good reference material for understanding the > Authorization header in Section 5.1 of the OAuth 2.0 draft 8 > spec<http://tools.ietf.org/id/draft-ietf-oauth-v2-08.html#authz_header> and > the WWW-Authenticate section 6? > > Specifically, some questions I have are: > > 1. How to properly escape the access token for inclusion in the header? > (suppose a linefeed or null character were in the token... how to escape > that?) > 2. What do RWS and OWS stand for? > 3. What is the "realm" value? Is the "service" string that is always > set as its value a literal, or a placeholder? What are some actual values > that might appear? > > I'm sure there's an RFC out there that describes all this stuff. RFC 2617 > is mentioned as a source for some of this, but "RWS" doesn't show up > anywhere in that RFC, for example, so I'm not sure where the best place is > to look this up in. > > Thanks. > -- > Andrew Arnott > "I [may] not agree with what you have to say, but I'll defend to the death > your right to say it." - S. G. Tallentyre > >
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
