BC - The current text actually specifies the AS to ignore them and not return a error

"The current text causes the AS to ignore them and not return a error. " - except that I don't believe the current text actually specifies that anywhere. And I think that the intent of Mike's original comment was that -13 doesn't specify the behavior but that it needs to be revised to do so.

I'd suggest that the doc say that the client must include in the request object (request or request_uri) all the oauth parameters that it sends. And when request or request_uri is sent, that the AS must/should only rely on parameter values from the request object.

I think being semi or somewhat compatible or tolerant of the Connect variation or request/request_uri is good because it uses the same parameter names, the same endpoint, and the same metadata names.

Comments (1)