Clarify various error codes on invalid clients
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
What error is returned in case the request object cannot be verified? According to JAR (RFC9101) it is invalid_request_object, but we basically say that for error codes RFC6749 should be followed. In this case, it would be invalid_request.
We need to clarify this ambiguity.
I don't think it helps to have a contradiction with JAR there. We should add a general note to the error response section that generally says that error codes follow what is defined in the relevant OAuth extension if applicable. Possibly it is not needed if OAuth makes this clear enough but perhaps worthwhile repeating/ reminding implementers that those apply. In general, OAuth covers these extension error codes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the error response section and compare its RFC6749 wording with the JAR (RFC9101) error code described in the issue. Clarify how applicable OAuth extension error codes should be handled, ensuring the guidance no longer conflicts with JAR. Done means the ambiguity is resolved in the specification text.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100