Aaron Parecki<https://twitter.com/aaronpk> and I have published a draft of the "OAuth 2.0 Protected Resource Metadata" specification that addresses all the issues that we're aware of. In particular, the updates address the comments received during the discussions at IETF 118. As described in the History entry for -02, the changes were: * Switched from concatenating .well-known to the end of the resource identifier to inserting it between the host and path components of it. * Have WWW-Authenticate return resource_metadata rather than resource.
The specification is available at: * https://www.ietf.org/archive/id/draft-ietf-oauth-resource-metadata-02.html -- Mike P.S. This note was also published at https://self-issued.info/?p=2486 and referenced from https://twitter.com/selfissued/status/1750366239493677354.
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
