Dear WG,
we released version -12 of Attestation-Based Client Authentication. This
includes the feedback that we received during WGLC. In particular the
following normative changes were made:
# make iat claim of Client Attestation JWT REQUIRED
# Feedback suggested that this allows AS to easier distinguish the
freshness of a client attestation, if this is a requirement for the
AS, it also fits well with the existing error "use_fresh_attestation"
# added text on HTTP status codes for the errors
# previously there was no statement on HTTP status codes, we added
400/401 for AS and 401 for RS as a SHOULD
The full changelog is available here:
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-attestation-based-client-auth-12#name-document-history
Best regards,
Paul+Christian
_______________________________________________
OAuth mailing list -- [email protected]
To unsubscribe send an email to [email protected]
