Open sebsel opened 5 years ago
Because the token endpoint part of the flow seems to solely use Bearer tokens and rely a lot on core OAuth 2.0 mechanics (e.g. revocation is basically RFC 7009 without modifications), I went with RFC 6750 error responses for Mintoken. Those all use WWW-Authenticate: Bearer
.
The AutoAuth draft also went with WWW-Authenticate: Bearer
, although I forget the rationale behind that. @sknebel mind commenting?
That said it may be nice to get some examples and/or clarifications about error responses in the IndieAuth spec. As I still have questions.
The spec states the following:
Then, for a 401, we should also add a
WWW-Authenticate
header:What kind of challenge should that be? Is the header
WWW-Authenticate: IndieAuth
acceptable, should it beWWW-Authenticate: Bearer
, or something different?