[Openid-specs-ab] Breaking change in OAuth 2.0 rev. 23

Nat Sakimura sakimura at gmail.com
Wed Mar 14 11:02:36 UTC 2012


I only noticed now that rev 23 had a breaking change. it seems to
doesn't allow the response_type=code token unless we define another client
type such as "hybrid".

This is a breaking change.

I wonder why I did not notice it till now.

See below.

>From section 2.1of
http://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-oauth-v2-23.txt

"A client application consisting of multiple components, each with its
own client type (e.g. a distributed client with both a confidential
server-based component and a public browser-based component), *MUST*
register each component separately as a different client to ensure
proper handling by the authorization server."

Discuss.

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20120314/04f194af/attachment.html>


More information about the Openid-specs-ab mailing list