Andrii Deinega

the invalid_client error and HTTP authentication schemas

2

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-09#section-3.2.3.1 says that > "**invalid_client**": Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The authorization server MAY return an HTTP 401 (Unauthorized) status code...

Character encoding for the application/x-www-form-urlencoded format

1

Section 3.2.2 Tokens states that > The client makes a request to the token endpoint by sending the > following parameters using the application/x-www-form-urlencoded > format per Appendix B with...

Specify character encoding for application/x-www-form-urlencoded

5

I suggest to specify explicitly the character encoding for the application/x-www-form-urlencoded mime-type, thus examples such as > POST /token HTTP/1.1 > Host: server.example.com > Content-Type: application/x-www-form-urlencoded > Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW...

Proposed changes for https://github.com/oauth-wg/oauth-v2-1/pull/224#discussion_r2441536553.

information that gets embedded in the compressed bitstring (GZIP)

1

RFC 1952 tells us that GZIP member header stores information about 1. MTIME (if the compressed data did not come from a file, MTIME is set to the time at...

a decompression bomb and maximumNumberOfEntries

1

The specification states that > This specification uses a minimum list length of 131,072. and > The default status list size is 131,072 entries, equivalent to 16 KB of single...