Subject: [OAUTH-WG] Details on the Facebook OAuth 2.0 implementation

From: Luke Shepard <[email-masked]>
Date: Thu, 13 May 2010 21:13:15 -0700

Hey everyone,

I wrote up a post giving detail about exactly what Facebook has and has not implemented from the OAuth 2.0 spec (with plenty of supporting links):

http://www.sociallipstick.com/?p=239

In summary:

- Current as of v0 of the draft. I think we are mostly current with v4 (although I haven't looked through every one of the diffs)
- Support the web_server, user_agent, and client_credentials flows
- No support for signatures, immediate mode, client state parameter, or refresh tokens, but these all plan to add in the future
- Support the proposed display parameter
- Error support is not quite consistent and we are working to clean it up
- We'd like to see support for a "display" parameter added to the spec (and will write language for it)

Our general attitude is this: we are strong supporters of OAuth 2.0 and we want to see it become a core piece of internet infrastructure. To that end, I plan to be active on this list and release periodic upgrades to stay in sync with the spec.

However, since it is far easier to add a feature than to change or remove it, we have shipped the most stable core and avoided the controversial or unfinished sections of the spec. When in doubt, we will likely not ship a feature until it seems like it has stabilized. Eran has done a great job driving many of the open issues to a close.

I'm sure I missed a bunch of detail so please let me know if you have any questions!
- Luke