Hi Yaron, Thanks. 8.2 lets the AS fall back to local policy when the resource's metadata isn't available. 9.3 doesn't tie a token to a metadata version either. Once a token's issued there's no way to tell which description it was checked against, or whether it was checked against one at all. If a resource tightens payments.manage later it can't tell its old tokens from its new ones.
Could the issuance record carry a digest of the description the AS used and when it was fetched, or a flag when it fell back to local policy? Blake _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
