Hi Yaron, Thankyou, amb covers it. The resource needs it because of your fourth point. Its metadata only tightens what the AS issues if the AS used it. Without amb the resource can't see whether it did.
Rejecting tokens issued before an update doesn't close that either. 9.3 lets the AS cache. A token issued after the update can still have been checked against the old description. With the digest in amb the resource can refuse any token that doesn't carry the current one and refuse "local" for scopes where it wants its own description applied. Blake _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
