+1 to capturing this as a distinct case, and to the terminal-disposition requirement.
>From the resource-server operator side: a client that goes silent after a 401 >leaves the RS unable to distinguish policy refusal, unsupported flow, pending >user interaction, and failure. All four look identical in logs, which hurts >both incident triage and audit evidence. Even a small enumerated disposition >set returned to the RS would close most of that gap. Happy to review proposed text when the issue is opened. Cliff Singletary
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
