[Ace] Token (In)Security

[Stefanie Gerdes <[e-mail]>]

Hi all,

as I understand the current proposal of the ACE framework, an attacker
can send an access token to the RS that only contains a scope and is not
signed or otherwise protected. Section 5.8.1.1 (titled verifying an
access token) does not state that RS must check the authenticity of the
token, therefore RS can accept it. Since the token does not contain an
exp field, it is infinitely valid. The attacker thus gains infinite
unconditional access. Is this really what we want from a security framework?

I would expect section 5.8.1.1 to provide information if and when RS
must check that the token stems from an authorized AS to prevent this
scenario.

Viele Grüße
Steffi