Standard 2.3.1.3.3 - Questions about requiring a unique Request File URL for each request

[Michael Jones]

The spec says "Note that the RP SHOULD use a unique URI for each request, or otherwise prevent the Authorization Server from caching the request_uri."

Yaron Goland wrote: Huh? If the client can upload a file then it can surely upload a POST in which case the whole point of the Request File feature is meaningless. I’m missing something.

Also, why must the request file be unique per request?

[Nat Sakimura]

distinct request

[Michael Jones]

Fix #351 Standard 2.3.1.3.3 - Questions about requiring a unique Request File URL for each request

→ f08cf25612d5