[Openid-specs-ab] Dynamic registration possible errata

[William Denniss]

+openid-specs-ab

Please note the below errata for dynamic client registration.

The clarification is that either custom URI schemes (com.example.app:/*),
or a localhost redirect with http (http://localhost:*/*) schemes are
acceptable redirects for Native Clients – there is no requirement that
localhost must be used with a custom URI scheme (in fact such redirects
have no host component).

Should we also explicitly mention that the IP literal form in place of
localhost is acceptable?  i.e. 127.0.0.1 and [::1]?

On Thu, Dec 8, 2016 at 10:18 AM, Mike Jones <Michael.Jones at microsoft.com>
wrote:

> I'll add it to my errata issues list.  Thanks!
>
> -----Original Message-----
> From: John Bradley [mailto:ve7jtb at ve7jtb.com]
> Sent: Thursday, December 8, 2016 10:14 AM
> To: Mike Jones <Michael.Jones at microsoft.com>
> Cc: William Denniss <wdenniss at google.com>
> Subject: Dynamic registration possible errata
>
> William found a developer with a interesting take on the registration spec.
>
> They are trying to enforce localhost for custom scheme URI
>
> The relevant sentence is:
> Native Clients MUST only register  redirect_uris using custom URI schemes
> or URLs using the http: scheme with localhost as the hostname.
>
> The way I intended that to be parsed was
>
> Native Clients MUST only register  (redirect_uris using custom URI
> schemes) or (URLs using the http: scheme with localhost as the hostname).
>
> At least this reader is parsing it as:
>
> Native Clients MUST only register  (redirect_uris using custom URI schemes
> or URLs using the http: scheme ) with localhost as the hostname.
>
> Perhaps a comma before the or?
>
> What is your opinion as grammar expert.
>
> If we can make that clearer we should in the upcoming errata.
>
> John B.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20170226/f5e8d16b/attachment.html>