Subject: [OAUTH-WG] Question about error response rule described in section 4.3 of draft v.10

From: "matake@gmail" <[email-masked]>
Date: Thu, 16 Sep 2010 22:52:20 +0900

Hi experts,

I'm now developing OAuth2 server library in Ruby, rack-oauth2.

I have one question about error response.

In section 4.3, it says

"If the client provided invalid credentials using an HTTP authentication scheme via the "Authorization" request header field, the authorization server MUST respond with the HTTP 401 (Unauthorized) status code.Otherwise, the authorization server SHALL respond with the HTTP 400 (Bad Request) status code."

In which case, client sends credentials via the "Authorization" request header?
In my understanding, client put any credentials in request body when obtaining an access token.
Is there some use-cases I'm missing?

Thanks

--
Nov Matake (=nov)
http://matake.jp
http://twitter.com/nov

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 18 Sep 2010 20:14:04 +0200

Default for client password authentication is HTTP BASIC (cf. 
http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-2.1)

regards,
Torsten.
Am 16.09.2010 15:52, schrieb matake@gmail:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: "matake@gmail" <[email-masked]>
Date: Sun, 19 Sep 2010 09:54:28 +0900

Ah, I see.
Thanks!

--
nov

On Sep 19, 2010, at 3:14 AM, Torsten Lodderstedt <[email-masked]> wrote:

> Default for client password authentication is HTTP BASIC (cf. http://tools.ietf.org/html/draft-ietf-oauth-v2-10#section-2.1)
> 
> regards,
> Torsten.