Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-dyn-reg-06.txt

[Torsten Lodderstedt]

>or non-existent. Note that for security reasons, to inhibit brute force
>attacks, endpoints MUST NOT return 404 Not Found error codes.
>
>From a security point of view differentiating the two is bad as it
>helps an attacker find valid notes to brute force.  Ideally you want an
>attacker to spend time truing to break into resources that don't exist
>as well as ones that do.

Good point!

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth