[OAUTH-WG] OAuth Core -29 and OAuth Bearer -22 specs published

Mike Jones <Michael.Jones@microsoft.com> Fri, 13 July 2012 00:25 UTC

Received-SPF: pass (mail9-ch1: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14MLTC102.redmond.corp.microsoft.com ; icrosoft.com ;
From: Mike Jones <Michael.Jones@microsoft.com>
To: "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: OAuth Core -29 and OAuth Bearer -22 specs published
Thread-Index: Ac1gjhZwVHhn22y2T/WdpE7Ba6CGRA==
Date: Fri, 13 Jul 2012 00:26:24 +0000
Message-ID: <4E1F6AAD24975D4BA5B168042967394366723810@TK5EX14MBXC285.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B168042967394366723810TK5EX14MBXC285r_"
MIME-Version: 1.0
Cc: Julian Reschke <julian.reschke@gmx.de>
Subject: [OAUTH-WG] OAuth Core -29 and OAuth Bearer -22 specs published
Precedence: list

New versions of the OAuth Core and Bearer specs have been published that are intended to address all outstanding issues. (Although see Dick Hardt’s forwarded note from Charles Honton, which may result in an additional issue.)

The specifications are available at:

· http://tools.ietf.org/html/draft-ietf-oauth-v2-29

· http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-22

Changes in http://tools.ietf.org/html/draft-ietf-oauth-v2-29 are:

* Added "MUST" to "A public client that was not issued a client password MUST use the client_id request parameter to identify itself when sending requests to the token endpoint" and added text explaining why this must be so.
* Added that the authorization server MUST "ensure the authorization code was issued to the authenticated confidential client or to the public client identified by the client_id in the request".
* Added Security Considerations section "Misuse of Access Token to Impersonate Resource Owner in Implicit Flow".
* Added references in the "Implicit" and "Implicit Grant" sections to particularly pertinent security considerations.
* Added appendix "Use of application/x-www-form-urlencoded Media Type" and referenced it in places that this encoding is used.
* Deleted ";charset=UTF-8" from examples formerly using "Content-Type: application/x-www-form-urlencoded;charset=UTF-8".
* Added the phrase "with a character encoding of UTF-8" when describing how to send requests using the HTTP request entity-body.
* For symmetry when using HTTP Basic authentication, also apply the application/x-www-form-urlencoded encoding to the client password, just as was already done for the client identifier.
* Added "The ABNF below is defined in terms of Unicode code points [W3C.REC‑xml‑20081126]; these characters are typically encoded in UTF-8".
* Replaced UNICODENOCTRLCHAR in ABNF with UNICODECHARNOCRLF = %x09 / %x20-7E / %x80-D7FF / %xE000-FFFD / %x10000-10FFFF.
* Corrected incorrect uses of "which".
* Reduced multiple blank lines around artwork elements to single blank lines.
* Removed Eran Hammer's name from the author list, at his request. Dick Hardt is now listed as the editor.

Changes in http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-22 are:

* Removed uses of HTTPbis in favor of RFC 2616 and RFC 2617, since HTTPbis is not an approved standard.
* Match formatting of artwork elements with OAuth core specification.

HTML-formatted versions are available at:

· http://self-issued.info/docs/draft-ietf-oauth-v2-29.html

· http://self-issued.info/docs/draft-ietf-oauth-v2-bearer-22.html

Thanks to Dick Hardt for editing the Core specification. Thanks to Julian Reschke for supplying the text in Core Appendix B on the use of the application/x-www-form-urlencoded encoding.

-- Mike

[OAUTH-WG] OAuth Core -29 and OAuth Bearer -22 sp… Mike Jones