Subject: [OAUTH-WG] SHOULD vs MUST for indicating scope on response when different from client request

From: Eran Hammer <[email-masked]>
Date: Fri, 20 Jan 2012 16:19:12 -0700

The current text:

   If the issued access token scope
   is different from the one requested by the client, the authorization
   server SHOULD include the "scope" response parameter to inform the
   client of the actual scope granted.

Stephen asked why not a MUST. I think it should be MUST. Any disagreement?

EHL

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 21 Jan 2012 00:20:16 +0100

MUST sounds reasonable 

Eran Hammer <[email-masked]> schrieb:

The current text:

EHL

---

From: Dick Hardt <[email-masked]>
Date: Fri, 20 Jan 2012 16:50:50 -0700

+!

On Jan 20, 2012, at 4:20 PM, Torsten Lodderstedt wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Igor Faynberg <[email-masked]>
Date: Fri, 20 Jan 2012 19:39:35 -0500

+1 for MUST.

In addition, I suggest slight rewarding: "the authorization server MUST 
include  the value of  the  scope  parameter in the response" in place of
"
the authorization
    server SHOULD include the "scope" response parameter
"

I think there is one parameter, scope, right?

Igor

On 1/20/2012 6:50 PM, Dick Hardt wrote:
>> Eran Hammer <[email-masked] <mailto:[email-masked]>> schrieb:
>>
>>     The current text:
>> [email-masked] <mailto:[email-masked]>

---

From: John Bradley <[email-masked]>
Date: Fri, 20 Jan 2012 22:22:00 -0300

+1

Sent from my iPhone

---

From: Justin Richer <[email-masked]>
Date: Mon, 23 Jan 2012 11:27:31 -0500

+1, sounds reasonable to me and I don't see why not. Also, it fits with 
current implementations that I'm familiar with.

  -- Justin