<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div>
<div style="font-family: Calibri,sans-serif; font-size: 11pt;">Is there a test or tests we should add for these protocol usages?<br>
</div>
</div>
<hr>
<span style="font-family: Tahoma,sans-serif; font-size: 10pt; font-weight: bold;">From:
</span><span style="font-family: Tahoma,sans-serif; font-size: 10pt;">John Bradley</span><br>
<span style="font-family: Tahoma,sans-serif; font-size: 10pt; font-weight: bold;">Sent:
</span><span style="font-family: Tahoma,sans-serif; font-size: 10pt;">2/5/2012 2:59 PM</span><br>
<span style="font-family: Tahoma,sans-serif; font-size: 10pt; font-weight: bold;">To:
</span><span style="font-family: Tahoma,sans-serif; font-size: 10pt;">Mike Jones</span><br>
<span style="font-family: Tahoma,sans-serif; font-size: 10pt; font-weight: bold;">Cc:
</span><span style="font-family: Tahoma,sans-serif; font-size: 10pt;">Roland Hedberg; openid-specs-ab@lists.openid.net</span><br>
<span style="font-family: Tahoma,sans-serif; font-size: 10pt; font-weight: bold;">Subject:
</span><span style="font-family: Tahoma,sans-serif; font-size: 10pt;">Re: [Openid-specs-ab] Authz methods</span><br>
<br>
Endpoints should support both GET and POST unless the spec specifically restricts itself to one or the other.<br>
<br>
If using GET it is STRONGLY recommended that tokens not be passes in query parameters.<br>
<br>
So GET effectively requires Authentication header support.<br>
<br>
Some simple clients may not have access to modify headers, requiring POST.<br>
<br>
John B.<br>
On 2012-02-05, at 7:14 PM, Mike Jones wrote:<br>
<br>
> You're right that the Bearer spec doesn't say what method to use because HTTPbis doesn't either. I expect that people will normally use GET however. Is there a reason you believe that clients may want to use POST?<br>
> <br>
> Unless there's an advantage to using POST over GET, given we're trying to test "normal cases" for this round of interop, I don't see a strong motivation to test using POST. But I'm adding the working group to my reply in case anyone else would like to weigh
in.<br>
> <br>
> Thanks again,<br>
> -- Mike<br>
> <br>
> -----Original Message-----<br>
> From: Roland Hedberg [mailto:roland@catalogix.se] <br>
> Sent: Saturday, February 04, 2012 1:41 PM<br>
> To: Mike Jones<br>
> Subject: Authz methods<br>
> <br>
> Hi Mike,<br>
> <br>
> Just to check my understanding.<br>
> <br>
> draft-ietf-oauth-v2-bearer-15 isn't explicit on this.<br>
> <br>
> When you're using the "Authorization" header field it doesn't specify whether GET or POST is used.<br>
> The example is GET but nowhere in the text is says it has to be GET.<br>
> Form-encoded body part on the other hand is always POST.<br>
> <br>
> So in you test matrix shouldn't we have:<br>
> <br>
> UserInfo Endpoint Access with Header Method (GET) UserInfo Endpoint Access with Header Method (POST) UserInfo Endpoint Access with Form-Encoded Body Method<br>
> <br>
> and likewise for Check ID ?<br>
> <br>
> -- Roland<br>
> <br>
> <br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Openid-specs-ab mailing list<br>
> Openid-specs-ab@lists.openid.net<br>
> http://lists.openid.net/mailman/listinfo/openid-specs-ab<br>
<br>
</body>
</html>