<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://1334/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I made similar comments in the other thread.<div><br></div><div>As for moving them to query parameters, I am not keen on a endless string of query parameters, and having two ways to do the saker thing leads to interop issues.</div><div><br></div><div>For max_age you don't necessarily want the user to be able to modify that in the request, that might cause security issues if auth_time is not required in the response, the RP may be thinking it is getting a stronger authentication than it is in reality.</div><div><br></div><div>I would prefer to leave max_age in the signed request and not confuse the lower security parameter based request with it.</div><div><br></div><div>There is no security implication for preferred_locales so I would make that a query parameter, and allow it to be in the request object but not require it.</div><div><br></div><div>John B.</div><div><br></div><div><br></div><div><div><div>On 2013-02-01, at 3:15 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Currently “preferred_locales” and “max_age” are specified as occurring under the “userinfo” and “id_token” elements of the request object. I would propose moving them up to being top-level elements of the request object, and possibly also allowing them to be used directly as request parameters. My reasoning is that it makes no practical sense to use different locales for UserInfo claim values versus ID Token claim values. Likewise, while “max_age” does apply logically to the ID Token, it would cause no confusion to have it apply to the whole request and it could be useful to allow specifying “max_age” as a query parameter.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">One consequence of allowing “preferred_locales” to also be specified as a query parameter is that its syntax would change from a JSON array to a space-separated list of strings.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">If we did this change, it would both simplify the parsing for the MTI Fallback Position described in my previous message (one would just ignore “userinfo” and “id_token” rather than ignoring the “claims” members of “userinfo” and “id_token”) and would enable more important functionality to be used without using the request object, which I think would make many developers happy.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Thoughts?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "> -- Mike<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></blockquote></div><br></div></body></html>