Avoid authorization information inside HTTP body about tent.io HOT 4 CLOSED

The id in the Authorization header is the MAC key identifier, which happens to be the same as the follower id in the HTTP response. The mac_algorithm probably won't end up in that response as it only needs to be transmitted to the following server once.

from tent.io.

Please don't close this one too soon ;-)

I don't see why you should couple both ids then, since the draft spec says the MAC key identifier is "[a] string identifying the MAC key used to calculate the request MAC. The string is usually opaque to the client."
That makes it a triple redundancy:

1. it's part of the URI
2. it's part of the HTTP headers
3. it's part of the HTTP body
   This tight coupling is unnecessary.

I was talking about the mac_algorithm being in the request (not response). It doesn't belong there: it's part of the protocol, not of the resource.

Please consider reopening this issue and removing these fields from the body: they introduce unnecessary coupling, which can't be good in the long term.

from tent.io.

Ah, I see your point, I'll make sure it gets addressed.

from tent.io.

This is fixed in the latest version of the documentation, let me know if you have further concerns.

from tent.io.