Re: [OAUTH-WG] Missing response_type with implicit and code flows on the same path

2016-02-10 Thread Vladimir Dzhuvinov
On 09/02/16 18:21, Sergey Beryozkin wrote: > Hi Vladimir > > Thanks for the response, > On 09/02/16 16:09, Vladimir Dzhuvinov wrote: >> Hi Sergey, >> >> Yes, HTTP 400 is one way to handle a missing response_type with a >> "universal" authz endpoint. >> > Indeed, looks like it makes sense >> Or, y

Re: [OAUTH-WG] Initial OAuth working group Discovery specification

2016-02-10 Thread Phil Hunt
Justin, The abstract to 7033 says. This specification defines the WebFinger protocol, which can be used to discover information about people or other entities on the Internet using standard HTTP methods. WebFinger discovers information for a URI that might not be usable as a locator

Re: [OAUTH-WG] Missing response_type with implicit and code flows on the same path

2016-02-10 Thread Sergey Beryozkin
Hi I got it, thanks for clarifying the idea :-) Thanks, Sergey On 10/02/16 07:59, Vladimir Dzhuvinov wrote: On 09/02/16 18:21, Sergey Beryozkin wrote: Hi Vladimir Thanks for the response, On 09/02/16 16:09, Vladimir Dzhuvinov wrote: Hi Sergey, Yes, HTTP 400 is one way to handle a missing

Re: [OAUTH-WG] Missing response_type with implicit and code flows on the same path

2016-02-10 Thread John Bradley
This trick works for the response types that use the GET POST and fragment encoded response modes. In the future if we do a Java Script response mode as is being proposed that might not always be the case. Just a heads up. Regards John B. > On Feb 10, 2016, at 7:09 AM, Sergey Beryozkin wrote