<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<span style="font-family:
"Helvetica","sans-serif";">Hi,<br>
<br>
I noticed that the user info endpoint requires the token to be
passed in the access_token parameter. Is there a reason this
endpoint isn't a full OAuth2 endpoing? Should the endpoint allow
the access_token to be specified in the HTTP Authorization header?
The spec currently doesn't define error responses, etc. I think it
would be valuable to just say the endpoint is an OAuth2 compatible
endpoint and we can then leverage all the error flows from the
OAuth2 spec.<br>
<br>
I'm also assuming that the user info endpoint allows both GET and
POST but only over SSL. It might be good clarify that as well.<br>
<br>
Thanks,<br>
George</span>
<pre class="moz-signature" cols="72">--
Chief Architect AIM: gffletch
Identity Services Engineering Work: <a class="moz-txt-link-abbreviated" href="mailto:george.fletcher@teamaol.com">george.fletcher@teamaol.com</a>
AOL Inc. Home: <a class="moz-txt-link-abbreviated" href="mailto:gffletch@aol.com">gffletch@aol.com</a>
Mobile: +1-703-462-3494 Blog: <a class="moz-txt-link-freetext" href="http://practicalid.blogspot.com">http://practicalid.blogspot.com</a>
Office: +1-703-265-2544 Twitter: <a class="moz-txt-link-freetext" href="http://twitter.com/gffletch">http://twitter.com/gffletch</a>
</pre>
</body>
</html>