Re: [Ace] Token (In)Security

[Stefanie Gerdes <[e-mail]>]

Hi Ludwig,

That's better, thanks.

Viele Grüße
Steffi

On 01/11/2019 02:09 PM, Ludwig Seitz wrote:
> Hi,
> 
> I've merged Hannes' PR, fixed a typo and added a sentence as follows:
> =====================================================================
> For self-contained tokens the RS MUST process the security protection of
> the token first, as specified by the respective token format. ~snip~
> This MUST include a verification that security protection (and thus the
> token) was generated by an AS that has the right to issue access tokens
> for this RS.
> =====================================================================
> 
> I have not extended this requirement to tokens passed as a reference,
> since in that case the RS needs to do introspection at an authorized AS
> anyways. It would thus not get the claims of a token issued by an
> unauthorized AS, which would in turn lead to the token being discarded.
> 
> Does that sound correct to you all?
> 
> /Ludwig
>