FAPI part 2 - request_uri mandatory or optional?

[Torsten Lodderstedt]

§5.2.2.#1 requires the AS to enforce the "request" or "request_uri" parameter wheras §5.2.2#10/11 just make "request" mandatory to implement and "request_uri" optional

In my opinion, #1 should at least be extended to state "request_uri" shall be enforced if supported by the AS

[Nat Sakimura]

Could you explain a bit more on the reasoning for "enforcing" "request_uri"?

[Torsten Lodderstedt]

The spec states "In addition, the authorization server, for the Write operation, ... shall require the request or request_uri parameter to be passed as a JWS signed JWT as in clause 6 of [OIDC];"

My interpretation of this statement is that the AS expects the RP to send request or request_uri. Since request_uri is not mandatory to implement, it only makes sense to require request_uri if the AS supports it.

[Torsten Lodderstedt]

please review the pull request

[Nat Sakimura]

Which pull request? Could you give me the number?

[Torsten Lodderstedt]

pull request #63

[Torsten Lodderstedt]

modified wording

[Joseph Heenan]

closed by #63