[OAUTH-WG] Secdir last call review of draft-ietf-oauth-resource-metadata-08

[David Mandelberg via Datatracker <[e-mail]>]

Reviewer: David Mandelberg
Review result: Has Nits

Overall, looks good. I just have a couple of questions that might not need any
changes to the doc.

Section 5.2 says "SHOULD retrieve the updated protected resource metadata and
use the new metadata values obtained" which makes sense for the values included
directly in the metadata. For the URLs like jwks_uri though, is the client
expected to retrieve those again even if the URL itself didn't change? Or does
that not need to be specified?

What do you think about adding something to section 5.2 about redoing all
validation (like checking the resource field and validating the signature in
signed_metadata) before using new values? I'd hope that any implementations
would do that without it being specified, but I could see some bugs if the code
path for fetching initial values is different than the code path for updating
values.