The text should say when the RS SHALL respond to the client with an authentication header indicating an error
Denisthemalice opened this issue · 3 comments
Section 5 is about Requesting Resources With Insufficient Access
This section has been imported from the main document. The second sentence states:
If the client instance calls an RS without an access token, or with an invalid access token, the RS MAY respond to the client instance with an authentication header indicating that GNAP needs to be used to access the resource.
The text should say exactly when the RS SHALL "respond to the client instance with an authentication header indicating that GNAP needs to be used to access the resource". There are other error cases which can be described using less than half a page.
The hierarchy between these errors cases should be indicated so that interoperability tests can be performed, i.e. some requests with intentionally included errors should produce the same error results between different implementations.
GNAP cannot definitively define all error responses across all different kinds of GNAP-protected APIs.
At the present time, the header error code that should be returned in the specific case which is being considered is not even indicated.