Dear Pedram, I'm interested in such a document as I'm operating a brokered OAuth platform which would benefit from this work.
As you know, I've engaged with section 2.4 and offered a solution for OAuth request delegation chains: https://datatracker.ietf.org/doc/draft-zehavi-oauth-authz-req-del-chain/ I support the creation of a new document and offer my help in any capacity you see fit. Regards, Yaron Classification: GENERAL -----Original Message----- From: Pedram Hosseyni <[email protected]> Sent: Monday, October 19, 2026 10:50 AM To: [email protected] Subject: [OAUTH-WG] Separate Document on Brokered OAuth Security This message is from an external sender - be cautious, particularly with links and attachments. Dear all, At IETF 126, we presented a new section in the draft updating the Security BCP, covering shared consent in brokered OAuth. [1] We discussed whether brokered OAuth architectures, including common deployment patterns and their security considerations should be addressed in a separate document. The current Section 2.4 of the BCP Update draft [2] could be moved to the new document. Would there be interest in creating such a document? Best, Pedram [1] https://datatracker.ietf.org/meeting/126/materials/slides-126-oauth-sessa-updates-to-oauth-20-security-best-current-practice-00 [2] https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics-update/03/ -- Dr. Pedram Hosseyni Institute of Information Security - SEC Universität Stuttgart Universitätsstraße 38 D-70569 Stuttgart Germany https://sec.uni-stuttgart.de/ _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected] This message and any attachment ("the Message") are confidential. If you have received the Message in error, please notify the sender immediately and delete the Message from your system, any use of the Message is forbidden. Correspondence via e-mail is primarily for information purposes. RBI neither makes nor accepts legally binding statements via e-mail unless explicitly agreed otherwise. Information pursuant to § 14 Austrian Companies Code: Raiffeisen Bank International AG; Registered Office: Am Stadtpark 9, 1030 Vienna, Austria; Company Register Number: FN 122119m at the Commercial Court of Vienna (Handelsgericht Wien). _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
