Registration 2.2 - Why must client_secret change with each response?

[Michael Jones]

The spec currently says that the client secret should change with each registration response. About this, Yaron Goland wrote:

Um… why? In fact given error recovery scenarios changing this on each request sounds like a bug, not a feature.

[Edmund Jay]

Add comment on why secret changes (for rotating secrets). Ask Yaron directly on what the question means.

[Michael Jones]

This may have to do with the "update" option, versus the "associate" option. Mike to ask Yaron for feedback.

[Michael Jones]

We should add an explicit parameter that requests a new client_secret and update the spec from saying that "This should change with each response" to reflect the addition of this parameter. We should also state that the client_secret must be different for different client_ids.

[John Bradley]

Fixes #363 Make rotate secret a separate type and stop client secret changing with every response.

→ cc00482872eb