search

openid / authzen

Proposed standard for an Authorization API
33 stars 10 forks source link

Multi-Language Support: don't reply with all languages #32

Open tulshi opened 1 year ago

tulshi commented 1 year ago

Discussed in https://github.com/SGNL-ai/authzapi/discussions/26

Originally posted by **baboulebou** June 28, 2023 I don't think it's a good idea to reply with all language strings, this could be a huge response and it would probably slow-down the PDP too. Instead, have the client PEP request the language it wants its responses in, and just return that 1 reason string. ==> This requires adding a Language parameter to the request calls.
rlenglet commented 1 year ago

Why couldn't we use standard HTTP language negotiation using the Accept-Language header? https://www.rfc-editor.org/rfc/rfc9110.html#name-accept-language

baboulebou commented 1 year ago

I like this idea...

davidjbrossard commented 1 year ago

I don't. I think we need to be careful what Accept-language has been used for previously and how it could interfere with our intended use. For instance, isn't accept-language widely used in APIs to discriminate between XML and JSON? Isn't that massively used by tools like code generators or Postman?

In my past experience, we had defined a language xacml+json to indicate we wanted a XACML request in JSON format. But that threw the Postmans of this world off.

On Thu, Jul 6, 2023 at 2:54 PM Alex Babeanu @.***> wrote:

I like this idea...

— Reply to this email directly, view it on GitHub https://github.com/SGNL-ai/authzapi/issues/32#issuecomment-1624355862, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABPRFP4QHKW2GNZW2LQZ7WDXO4X2FANCNFSM6AAAAAAZXY4MOI . You are receiving this because you are subscribed to this thread.Message ID: @.***>

--

David Brossard http://www.linkedin.com/in/davidbrossard http://twitter.com/davidjbrossard http://about.me/brossard

Stay safe on the Internet: IC3 Prevention Tips https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf Prenez vos précautions sur Internet: http://www.securite-informatique.gouv.fr/gp_rubrique34.html

rlenglet commented 1 year ago

@davidjbrossard you're probably referring to the Accept header (not Accept-Language)? https://www.rfc-editor.org/rfc/rfc9110.html#name-accept

davidjbrossard commented 1 year ago

Yes, probably, sorry.