The TL;DR here is a somewhat tentative suggestion that a brief security consideration be added to https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/ that prohibits the inclusion of a 'sub' claim containing the client id value in the request object JWT so as to prevent the request object JWT (which is exposed to the user agent) from being erroneously accepted as a valid JWT for client authentication.
Some more details and the discussion that led to this here email can be found at https://github.com/oauthstuff/draft-oauth-par/issues/41 -- _CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
