Source: http://self-issued.info/docs/draft-ietf-oauth-v2-bearer-10.html
Timestamp: 2017-03-23 18:14:06
Document Index: 210469875

Matched Legal Cases: ['art 1', 'art 7', 'art 1', 'art 7', 'art 7', 'art 7']

Expires: April 21, 2012independent
The OAuth 2.0 Authorization Protocol: Bearer Tokensdraft-ietf-oauth-v2-bearer-10
access to granted resources (without demonstrating possession
of a cryptographic key). To prevent misuse, the bearer token
MUST be protected from disclosure in storage and in transport.
This Internet-Draft will expire on April 21, 2012.
obtaining an access token, which is defined in [I‑D.ietf‑oauth‑v2] (Hammer-Lahav, E., Recordon, D., and D. Hardt, “The OAuth 2.0 Authorization Protocol,” September 2011.) as "a string representing an access
over HTTP (Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, “Hypertext Transfer Protocol -- HTTP/1.1,” June 1999.) [RFC2616] using TLS (Dierks, T. and E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2,” August 2008.) [RFC5246]. Other specifications may extend
notation of [I‑D.ietf‑httpbis‑p1‑messaging] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 1: URIs, Connections, and Message Parsing,” August 2011.),
which is based upon the Augmented Backus-Naur Form (ABNF)
notation of [RFC5234] (Crocker, D. and P. Overell, “Augmented BNF for Syntax Specifications: ABNF,” January 2008.). Additionally, the
following rules are included
from [I‑D.ietf‑httpbis‑p7‑auth] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 7: Authentication,” August 2011.): b64token, auth-param, and realm;
from [I‑D.ietf‑httpbis‑p1‑messaging] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 1: URIs, Connections, and Message Parsing,” August 2011.): quoted-string;
and from [RFC3986] (Berners-Lee, T., Fielding, R., and L. Masinter, “Uniform Resource Identifier (URI): Generic Syntax,” January 2005.): URI-Reference.
Clients MAY use bearer tokens to make authenticated requests
to access protected resources. This section defines three
method to transmit the token in each request
defined by [I‑D.ietf‑httpbis‑p7‑auth] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 7: Authentication,” August 2011.), the
[I‑D.ietf‑httpbis‑p7‑auth] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 7: Authentication,” August 2011.) follows:
SHOULD NOT be used unless it is the only feasible method.
[I‑D.ietf‑httpbis‑p7‑auth] (Fielding, R., Gettys, J., Mogul, J., Nielsen, H., Masinter, L., Leach, P., Berners-Lee, T., Reschke, J., and Y. Lafon, “HTTP/1.1, part 7: Authentication,” August 2011.) as follows:
scope           = "scope" "=" &lt;"&gt; scope-val *( SP scope-val ) &lt;"&gt;
error-desc      = "error_description" "=" &lt;"&gt; *error-desc-char &lt;"&gt;
error-uri       = "error_uri" "=" &lt;"&gt; URI-reference &lt;"&gt;
error_uri attribute MUST NOT appear more than once.
code (typically, 400, 401, or 403), and includes one of the following error codes in
confidentiality protection is applied via TLS (Dierks, T. and E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2,” August 2008.) [RFC5246] with a
utilize confidentiality protection.
made: First, the lifetime of the token MUST be limited by
the client and the resource server MUST be applied, for instance,
through the use of TLS (Dierks, T. and E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2,” August 2008.) [RFC5246]. As a
verify the identity of that resource server, as per [RFC2818] (Rescorla, E., “HTTP Over TLS,” May 2000.).
Clients MUST always use TLS (Dierks, T. and E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2,” August 2008.) [RFC5246]