Call out that client notification endpoint bearer token is not MTLS certificate bound

I believe the intention of the current spec is that the bear token the client gives the authorization server for accessing the client notification endpoint is not bound to a MTLS certificate.

I think we should probably more explicitly say this, and perhaps also make clear that this is presumably okay because the only real consequence of both the bearer token and the auth_req_id leaking would be some kind of denial of service attack where it’s possible for an attacker to cause the client to call the token endpoint before the authentication has actually completed.

Comments (3)