Spec says Authorization Server shall support both public and confidential clients;

[Dave Tonge]

However some implementations may only want to support confidential clients.

[Nat Sakimura]

At the time of the writing, I was assuming that banks are going to support mobile clients as well, but they apparently are not. Then, this requirement can be too demanding. We probably want to introduce some conditionals such as:

Authorization Server shall support confidential clients if it supports web server based clients. Authorization Server shall support public clients if it supports mobile clients. etc.

[Nat Sakimura]

On the related thing, needs for PKCE support can be optional. Having said that, since PKCE will prevent the privillage escalation by the code swap, it is better to have PKCE.

[Nat Sakimura]

Re: #73

→ <<cset 8d420fd67b79>>

[Sascha Preibisch]

What about "... shall support confidential clients and may support public clients .... "?