You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -329,35 +329,14 @@ The following authorization server metadata value is defined by this specificati
329
329
330
330
The idea of using URIs as the `client_id` in OAuth based authorization requests is not new, and has previously been specified in varying ways by [IndieAuth], [Solid-OIDC], and [OpenID.Federation]. This specification is largely inspired by the work of Aaron Coburn, elf Pavlik, and Dmitri Zagidulin in their [Solid-OIDC] specification which defined dereferenceable Client Identifier Documents.
331
331
332
-
The authors would like to thank the following people for their contributions and reviews of this specification: Dick Hardt, Matthieu Sieben, Filip Skokan.
332
+
The authors would like to thank the following people for their contributions and reviews of this specification: Brian Campbell, Dick Hardt, Leif Johansson, Pieter Kasselman, Bryan Newbold, Matthieu Sieben, and Filip Skokan.
333
333
334
334
335
335
# Document History
336
336
{:numbered="false"}
337
337
338
338
(This appendix to be deleted by the RFC editor in the final specification.)
339
339
340
-
-03
341
-
342
-
* Prohibit all forms of symmetric client authentication, not just client secret
343
-
* Added recommendations for development when clients are not on the web
344
-
* Added reference to HTTP Caching RFC9111
345
-
* Added security considerations around domain trust and changes in client keys
346
-
* Updated references
347
-
348
-
349
-
-02
350
-
351
-
* Added security consideration around displaying logos to end users
352
-
* Changed query string parameters in Client ID Metadata Document URLs to "SHOULD NOT", since this encourages bad security practices (e.g., minting documents based on query string parameters)
353
-
* Added prohibition on the `client_secret_expires_at` property, as it is not relevant for Client ID Metadata Documents.
354
-
* Added security consideration for development use-cases.
355
-
356
-
-01
357
-
358
-
* Added recommendation of max metadata document size
359
-
* Changed metadata property reference to IANA registry instead of Dynamic Client Registration
0 commit comments