Subject: [OAUTH-WG] error response for invalid refresh token

From: Peter Brindisi <[email-masked]>
Date: Tue, 21 Feb 2012 14:33:01 +0100

Hi all,

I am currently implementing version 23 of the oauth2 spec, and I came
across a bit of ambiguity. What is the appropriate error code for an
invalid refresh token? I am unsure whether it should be 'invalid_grant' or
'invalid_request'. Neither seems 100% clear.

Thanks in advance!

Best,
Peter

---

From: Buhake Sindi <[email-masked]>
Date: Tue, 21 Feb 2012 17:16:23 +0200

Hi

invalid_grant

The provided authorization grant (e.g. authorization code,
> resource owner credentials) is invalid, expired, revoked, does
> not match the redirection URI used
>

I would think that the refresh_token is an authorization code that needs
refreshing, so this would be valid.

On 21 February 2012 15:33, Peter Brindisi <[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>