I too have lots of opinions on this subject, but mine are generally less justified ;-)
1: 1 > 1a, because CORS is a pain in the behind and IMHO it's clearer to do DOMAIN/RESOURCE/ID
3/4: The OAuth standard suggests using an Authorization: header to hold an access token, which I'm +1 on because it's pretty straightforward and easy to understand. It'd be great if something else was supported as well but Authorization is a standard header and IMHO since the standard headers are available they should be used.
I would love to help out with this if possible, headspace and time constraints permitting :-)
no subject
1: 1 > 1a, because CORS is a pain in the behind and IMHO it's clearer to do
DOMAIN/RESOURCE/ID3/4: The OAuth standard suggests using an
Authorization:header to hold an access token, which I'm +1 on because it's pretty straightforward and easy to understand. It'd be great if something else was supported as well butAuthorizationis a standard header and IMHO since the standard headers are available they should be used.I would love to help out with this if possible, headspace and time constraints permitting :-)