reject vs ignore on plain (or outside PAR) authorization request parameters

[Filip Skokan]

5. shall reject authorization requests sent without [@I-D.lodderstedt-oauth-par] or authorization request parameters sent outside of the PAR request, except for request_uri and client_id

Is ignoring parameters outside of PAR as defined by JAR/PAR not sufficient? This is introducing yet another splinter of already so fractured specification family.

[Brian Campbell]

+1 and see also https://bitbucket.org/openid/fapi/issues/340/treatment-of-authorization-request

[Torsten Lodderstedt]

Wouldn’t be require_pushed_authorization_requests set to true define the desired behavior?

[Daniel Fett]

Yes, we can omit the whole second part of the clause.

[Daniel Fett]

Fix #347 and #340

→ <<cset 62909e4c84dc>>

[Daniel Fett]

Duplicate of #340.