|
- Definitions
- need to separately define two separate tokens
- API Endpoint URLs -- needs improved definition
- User should capitalized consistently
- remove callback URL
- change to OAuth Protocol Parameters
- Documentation and Registration
- used to be setting up for OAuth
- an additional sentence that explains consumer secret trustworthiness --> move to security considerations document
- changed MUST NOT to SHOULD NOT...
- removed last sentence contain "consumer type"
- Endpoint URLs
- scheme, host, port, path -- use fully qualified URLs, not method
- add example from RFC
- MUST contain OAuth Protocol Parameters
- Service Providers
- separating OAuth Endpoint URLs
- Change SHOULD to MUST
- Consumers
- removed two paragraphs...
- consumer developer MAY be required to provide addition info to SP
- Parameters
- change to OAuth Protocol Parameters
- Parameter Encoding
- added examples for the proper encoding code
- operating in UTF8 space
- url encoding
- general consensus on this part!
- Request Parameters
- pluralize API Endpoint URL
- soap, xml-rpc could have problems... use AUTH headers?
- rename section to "sending request parameters"?
- revise spec to cover post body being signed...
- Response Parameters
- adding example
- doesn't handle xml-rpc case
- everyone can split on equals and colon
- add a version number to every request not replies...
- change to URL encoding
- Using HTTP Authorization Headers
- Authorization Header
- use SHA1
- use alphanumerical
- WWW-Authenticate Header
- Authenticating with OAuth
- Obtaining a Request Token
- Consumer Requests a Request Token
- Service Provider Issues an Unauthorized Request Token
- Consumer Directs the User to the Service Provider
- Service Provider Authenticates the User and Obtains Consent
- Service Provider Directs the User Back to the Consumer
- Web-Based Consumers
- Limited Consumers
- Obtaining an Access Token
- Consumer Requests an Access Token
- Service Provider Grants an Access Token
- Accessing Protected Resources
- Signing API Requests
- Normalize Service Provider Request Parameters
- Generate a Nonce and Timestamp
- Concatenate Parameters into a String
- Calculate HMAC value
- Set Signature Parameters
- Build the Concatenated Request String
- Calculate RSA Signature Value
- Set Signature parameters
- HTTP Response Codes
- Appendix A – Protocol Example
- Documentation and Registration
- Obtaining a Request Token
- Requesting User Authorization
- Obtaining an Access Token
- Accessing Protected Resources
|
|
Version:
|
|
|
oauth3.png
oauth3
Unified Spec Notes
