search

aaronpk / oauth-first-party-apps

https://datatracker.ietf.org/doc/html/draft-parecki-oauth-first-party-apps
Other
10 stars 8 forks source link

error code vs error code #45

Closed bc-pi closed 7 months ago

bc-pi commented 9 months ago

There are a few places with text like:

The Authorization Server returns an Error Response ... including "error": "authorization_required", "auth_session", and a custom error code indicating that ...

but that "error": "authorization_required" is the error code so the text kinda contradicts itself. Doesn't it? Maybe I'm confused but I think (esp after looking at the example https://www.ietf.org/archive/id/draft-parecki-oauth-first-party-apps-00.html#appendix-B.2) it should just say something like "including an auth_session and a custom error code indicating that ..."

Also authorization_required seems to be defined as a token endpoint error while most/all instances of that kind of text are in response to an Authorization Challenge Request.

aaronpk commented 8 months ago

Thanks, we've addressed the two points here.

That should have been "custom property" instead of "custom error code".

We've renamed authorization_required to insufficient_authorization and defined it on both endpoints. Can you let me know if this clears it up?

bc-pi commented 8 months ago

Can you let me know if this clears it up?

I think so, yeah.