SECDIR Review: Section 10.2 - how to do the agreement between client and server "a priori"?

[Nat Sakimura]

Section 10.2 indicates that a client and server might agree, a priori, to use the non-protected parameters transmitted in a request. It does not indicate how this might have been done (hopefully, in a secure fashion).

[Nat Sakimura]

IMHO, that is out of scope of the document. It could have been an agreement in a risk evaluation f2f meeting. When it uses un-protected parameters, the authorization request is not secure within the application layer. However, there could be some other control mechanisms outside OAuth to make the transaction secure anyways.

[Nat Sakimura]

Fixed #27

→ <<cset 5cf1abbe08b8>>