indieweb / indieweb/indieauth

Standard mechanism for requesting a ticket auth ticket grant?

Open
#87 11 comments 0 reactions 0 assignees View on GitHub
ticketing extension
Dominant language
HTML
Stars
57
Forks
7
PR merge metrics
No merged PRs in 30d

Description

As an extension to Ticket Auth, it might be nice to optionally support the ability for someone to request a ticket to be sent to them by the provider's token endpoint. For example, if user `https://alice.example.com/` wants a ticket from `https://bob.example.com/`, then Alice could make a POST request to `https://bob.example.com/tokens` with parameters:

`grant_type=ticket_request&subject=https://alice.example.com/`

at which point Bob's token endpoint could (if supported) perform a `ticket_endpoint` discovery on Alice's profile page and then initiate the rest of the TicketAuth flow.

Alternately, this could signal Bob that there is a pending ticket request to send to Alice, and Bob can opt to continue the rest of the flow.

In effect, this would be an optional, standard "follow request" procedure, of which many developers are already baking something similar into their `grant_type=ticket` flows on their token endpoints for testing purposes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the Ticket Auth flow and the token endpoint behavior described in the issue. Define whether ticket_request should trigger ticket_endpoint discovery on the subject's profile or only notify the provider, and specify the complete request and completion behavior for a standard follow-request procedure.

Written by the indexing model from the issue text.

Assessment

Domain
api, authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.