Hi, Thank you all for your work on this draft! I just have a few questions:
1. Security considerations section says: "All of the normal security issues, especially in relationship to comparing URIs and dealing with unrecognized values, that are discussed in JWT [JWT] also apply here." I find that to be odd phrasing that would likely be picked up in subsequent reviews. Please remove the word "normal" so that all of the security issues discusses in JWT are included. Are there other 'normal considerations in addition to those in JWT that need to be listed? The phrasing reads as if that may the case and would be better to include them all or pointers or change the phrasing. 2. Also in the security considerations section, "A recipient may not understand the newly introduced "cnf" claim and may consequently treat it as a bearer token." What is the proper handling requirement when an unknown claim is present? Section 3.1 says: "When a recipient receives a "cnf" claim with a member that it does not understand, it MUST ignore that member." Is this why it is treated as a bearer token rather than being rejected? Is this really the action you want to see with cnf? Why isn't there an error and a resend as a bearer token so that parties understand (or have an opportunity to understand) that there were issues? Then the following text in the security section says: "While this is a legitimate concern, it is outside the scope of this specification, since demonstration the possession of the key associated with the "cnf" claim is not covered by this specification. For more details, How is this outside of the scope of this draft? cnf is defined in this draft, so handling should be covered in this draft. A pointer to the POP architecture draft is not helpful as it is not defined there, it's covered int his draft. Should this text just be removed and replaced with more explicit handling information int he body of this draft? Thanks! -- Best regards, Kathleen _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
