We just updated our Graph API's OAuth2 implementation to be draft 10 complaint. Yay!

Well, I should say we are pretty close to draft 10. Some places we differ:

* For now errors are not in the standard format :( This would break backwards compatibility and existing applications, so we are only going to turn it on for opted in applications until the spec is finalized. If anyone wants to use the new formats, send me your Facebook app's ID and I'll opt you in.
* if grant_type is not included, it is assumed to be "authorization_code" since that is what draft-00 did.
* If response_type is not included, it is assumed to be "code" since that is what draft-00 did.

When the spec is finalized, we plan on doing a single opt-in migration for all non-backwards compatible changes. New application will be automatically on the final version, and older applications will have a time period to update.

Some new things you can do:

Here are a few links showing some of the new parameters to help you with discovery:
code_and_token:
http://graph.facebook.com/oauth/authorize?client_id=150629244948164&r...
token:
http://graph.facebook.com/oauth/authorize?client_id=150629244948164&r...
new error format:
http://graph.facebook.com/oauth/access_token?client_id=15062924494816...
error redirects:
http://graph.facebook.com/oauth/authorize?client_id=150629244948164&r...

Feel free to ask questions and let me know if there are any places you don't think we are spec complaint. We plan on keeping up with changes as we all run this last mile to the final version.

Thanks!
Paul

_______________________________________________
OAuth mailing list
OA...@ietf.org
https://www.ietf.org/mailman/listinfo/oauth