#334: recipient behavior for new auth parameters

Hi there.

I recently opened (based on oauth-bearer discussions) the following ticket:

"Should we state the default behavior for extension auth-params? Is it 
"must-ignore"?

Should we recommend that new schemes establish procedures for defining 
new parameters?"

The proposed change is not to define a global default (although it would 
be nice if we could), but to remind people how define new schemes to 
think about this and to document it.

Like that:

   Definitions of new schemes ought to define the treatment of unknown
   extension parameters. In general, a "must-ignore" rule is preferable
   over "must-understand", because otherwise it will be hard to introduce
   new parameters in the presence of legacy recipients.

(<http://trac.tools.ietf.org/wg/httpbis/trac/attachment/ticket/334/334.diff>)

Feedback appreciated, Julian

Received on Wednesday, 29 February 2012 22:52:24 UTC