The web browser authentication method in section 5.2.9.3 has been criticized as difficult to implement.

I would like to propose an alternative. My proposal is here:
http://www.oasis-open.org/apps/org/workgroup/cmis/download.php/46128/BrowserBindingTokens.pdf

This alternative is easy to use by application and moderately difficult to implement by servers. I have built a sample implementation in Java. Contact me if you are interested.

This proposal also affects other parts of the browser binding chapter. For example, the field "cmistransaction" in sections 5.4.2.18 and 5.4.4.4 should be replaced with the tokens described in the proposal.