Web Resource Authorization Protocol (WRAP) is a profile of OAuth, also called OAuth WRAP. While similar in pattern to OAuth 1.0A, the WRAP profile(s) have a number of important capabilities that were not available previously in OAuth. This specification is being contributed to the IETF OAuth WG.

Questions and suggestion documentation changes can be made on the OAuth WRAP mailing list. Protocol changes should be discussed on the IETF list.

This group has also drafted the Simple Web Token (SWT) specification which defines an Access Token format that can be used within WRAP though there hasn't been much adoption or recent discussion of the proposal.

Reading the spec

The latest version of the spec is http://tools.ietf.org/html/draft-hardt-oauth-01 which obsolets 0.9.7.2.

Implementations

As of December 2009, Facebook has been working on implementing OAuth in the FriendFeed project. Relevant content and resources:

• OAuth WRAP support in FriendFeed for feedback - Bret Taylor
• Implementing the New OAuth WRAP - Facebook Developers Blog
• Google AppEngine example application (Source code on GitHub)
• OAuth WRAP in Javascript by Luke Shepard (Source code on GitHub)

Microsoft also provides Windows Azure platform AppFabric, which implements one profile of OAuth WRAP.