search

oauth-wg / oauth-transaction-tokens

MIT License
7 stars 10 forks source link

`txn` value should be optional #77

Closed tulshi closed 2 weeks ago

tulshi commented 3 months ago

From Yaron's feedback email

gffletch commented 3 months ago

Text from Yaron's email:

5.2: I think txn should be OPTIONAL. While it is very useful, there may be architectural reasons why transaction ID issuance in an organization is independent of transaction tokens.

gffletch commented 3 months ago

I'm curious to the use cases? I'd prefer a way to make the txn claim REQUIRED and allow an organization to provide it's own value in that context. Maybe we could go with RECOMMENDED? This is one of those cases where people who know what they are doing can potentially remove it or possibly provide a "N_A" value and it will be fine. However, if it's OPTIONAL most developers will not specify the value and then they will lose a lot of value from the Transaction Token.

yaronf commented 3 months ago

No specific use cases, it's just that we're assuming that an organization can easily integrate its (preexisting) transaction ID-issuing service with this one. Sometimes it can, sometimes it can't.

I'm good with RECOMMENDED.

gffletch commented 2 weeks ago

@yaronf please review PR #101 which addresses this issue