Subject: [OAUTH-WG] Draft OAuth Core spec changes updating proposed ABNF

From: Mike Jones <[email-masked]>
Date: Fri, 8 Jun 2012 07:56:04 +0000

The attached proposed edits to the Core spec update the ABNF to remove the character set restrictions that working group participants had objected to, and to define common syntax elements, where appropriate.  After working group review, I believe that these changes are ready to be checked in for draft 27 after being merged with whatever other changes Eran has made.

Source, .txt, and .html versions are attached.  Diffs for the consequential changes since my previous set of proposed changes follow.

                                                            -- Mike

3632,3633c3632,3633
>    Some of the definitions that follow use these common definitions:
>
>    VSCHAR     = %20-7E
>    NQCHAR     = %x21 / %x23-5B / %x5D-7E
>    NQSCHAR    = %x20-21 / %x23-5B / %x5D-7E
3657c3654
<    client-id     = *<TEXT excluding ":">
---
>    client-id     = *VSCHAR
3666c3663
<    client-secret = *TEXT
---
>    client-secret = *VSCHAR
3685c3682
<    scope-token = 1*( %x21 / %x23-5B / %x5D-7E )
---
>    scope-token = 1*NQCHAR
3686c3684
<    state      = 1*unreserved
---
>    state      = 1*VSCHAR
3712c3705
<    redirect-uri      = URI
---
>    redirect-uri      = URI-reference
3719,3720c3712
<    error             = 1*error-char
<    error-char        = %x20-21 / %x23-5B / %x5D-7E
---
>    error             = 1*NQSCHAR
3727,3728c3719
<    error-description = 1*error-char
<    error-char        = %x20-21 / %x23-5B / %x5D-7E
---
>    error-description = 1*NQSCHAR
3735c3726
<    error-uri         = URI
---
>    error-uri         = URI-reference
3742c3733
<    grant-type = grant-name / URI
---
>    grant-type = grant-name / URI-reference
3747c3741
<    code       = 1*unreserved
---
>    code       = 1*VSCHAR
3767c3761
<    access-token = b64token
---
>    access-token = 1*VSCHAR
3774c3768
<    token-type = type-name / URI
---
>    token-type = type-name / URI-reference
3788c3782
<    username = *<TEXT excluding ":">
---
>    username = *( %x20-39 / %x3B-7E )
3797c3792
<    password = *TEXT
---
>    password = *VSCHAR
3801c3797
<    refresh-token = b64token
---
>    refresh-token = 1*VSCHAR

---

From: Julian Reschke <[email-masked]>
Date: Fri, 08 Jun 2012 11:52:22 +0200

On 2012-06-08 09:56, Mike Jones wrote:
> The attached proposed edits to the Core spec update the ABNF to remove
> the character set restrictions that working group participants had
> objected to, and to define common syntax elements, where appropriate.
> After working group review, I believe that these changes are ready to be
> checked in for draft 27 after being merged with whatever other changes
> Eran has made.
> ...

As far as I can tell, you have chosen to restrict everything to 
US-ASCII. That definitively makes the ABNF and the wire representation 
simpler, but it does break I18N big time.

And please don't tell me that people do not use non-ASCII characters in 
credentials (-> <https://bugzilla.mozilla.org/show_bug.cgi?id=41489>).

Focusing on username and password... If this relates to the use in Basic 
and Digest, it's fine that it has their current limitations; but in that 
case the ABNF shouldn't invent new productions and claim that they match 
2617's when they do not.

If this relates to uses of usernames and passwords outside Basic and 
Digest (thus new uses), then I believe the proposed solution is not 
acceptable.

Best regards, Julian