On Thu, Oct 1, 2009 at 7:52 PM, George Fletcher <gffletch at aol.com> wrote: > One use case (I think I saw it mentioned somewhere else on the list) where > we've used the URI parameters is when we want the server to sign a URL and > then pass that signed value to the browser to load. This can be done with a > simple 302 and the signed URL. Switching to just supporting the > Authorization header will make this more difficult but probably not > impossible. Yep. I've seen that done multiple places. One more unexpected use of OAuth...
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.