Standard 2.3.1 - Does request_uri have to be HTTPS?

[Michael Jones]

Doesn't the request file have to be protected by TLS to prevent tampering? If so, the spec needs to say so. (If not, the spec should probably say why not.)

[John Bradley]

fixes #350 Sec 2.3.1.3 Clarify request_uri needs to be https unless the JWT is signed. re #379 Sec 2.3.1.3 Clarify request_uri dosen't need to be globally reachable

→ 1091e590530a