On Tue, Mar 16, 2021 at 05:45:46PM -0400, Rifaat Shekh-Yusef wrote: > Brian, > > For a nonce-based replay protection you. might want to look at the ACME > protocol here: > https://tools.ietf.org/html/rfc8555#section-6.5
Yes, that one is really solid for the sort of thing it does, and I find myself recommending it over and over again. Of course, that workflow is not universally applicable, so sometimes it's not the right thing to do (and I don't remember enough about DPoP to say if it works there). -Ben _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
