[OAUTH-WG] Weekly github digest (OAuth Activity Summary)

Repository Activity Summary Bot <do_not_reply@mnot.net> Sun, 27 April 2025 07:40 UTC

Feedback-ID: i1c3946f2:Fastmail
Content-Type: multipart/alternative; boundary="===============6315929994692717380=="
MIME-Version: 1.0
From: Repository Activity Summary Bot <do_not_reply@mnot.net>
To: oauth@ietf.org
Message-Id: <20250427074009.3A42C21AE324@mail2.ietf.org>
Date: Sun, 27 Apr 2025 00:40:09 -0700
Message-ID-Hash: MTPKQRSQIT2UBXND6H6KTNXZJJ7BINQ3
Precedence: list
Subject: [OAUTH-WG] Weekly github digest (OAuth Activity Summary)
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Fw59lg8HIyQhz1UQnHBdrN_RvOo>



Events without label "editorial"

Issues
------
* oauth-wg/oauth-browser-based-apps (+18/-1/💬13)
  18 issues created:
  - Level of detail of sections 6.1 / 6.2 / 6.3 (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/103 [iesg-feedback] 
  - Remove references to Facebook and Twitter (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/102 [iesg-feedback] 
  - clarify "previous recommendations" in Section 7 intro (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/101 [iesg-feedback] 
  - add reference for OpenID Scopes (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/100 [iesg-feedback] 
  - Extracting CryptoKeyPair (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/99 [iesg-feedback] 
  - add reference for confused deputy (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/98 [iesg-feedback] 
  - add reference for refresh token rotation (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/97 [iesg-feedback] 
  - Cookie security, why NOT MUST (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/96 [iesg-feedback] 
  - Add reference for "confidential client" (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/95 [iesg-feedback] 
  - Add reference for session fixation (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/94 [iesg-feedback] 
  - Clarify "first-party frontend" in the intro (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/93 [iesg-feedback] 
  - Rearrange intro (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/92 [iesg-feedback] 
  - Add more references to terminology when used (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/91 
  - Address IESG Reviews (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/90 [iesg-feedback] 
  - "hard drive" (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/89 
  - BFF Operational Considerations (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/88 [iesg-feedback] 
  - BFF as an HTTP Proxy (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/87 [iesg-feedback] [discuss] 
  - Consistency of Terms (by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/86 [iesg-feedback] [discuss] 

  7 issues received 13 new comments:
  - #103 Level of detail of sections 6.1 / 6.2 / 6.3 (2 by aaronpk, philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/103 [iesg-feedback] 
  - #96 Cookie security, why NOT MUST (2 by aaronpk, philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/96 [iesg-feedback] 
  - #94 Add reference for session fixation (1 by philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/94 [iesg-feedback] 
  - #90 Address IESG Reviews (2 by aaronpk, philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/90 [iesg-feedback] 
  - #88 BFF Operational Considerations (2 by aaronpk, philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/88 [iesg-feedback] 
  - #87 BFF as an HTTP Proxy (2 by aaronpk, philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/87 [iesg-feedback] [discuss] 
  - #86 Consistency of Terms (2 by aaronpk)
    https://github.com/oauth-wg/oauth-browser-based-apps/issues/86 [iesg-feedback] [discuss] 

  1 issues closed:
  - "hard drive" https://github.com/oauth-wg/oauth-browser-based-apps/issues/89 

* oauth-wg/oauth-identity-chaining (+1/-1/💬4)
  1 issues created:
  - Authorization server metadata to enable discovery of grant/token type (by aaronpk)
    https://github.com/oauth-wg/oauth-identity-chaining/issues/147 

  3 issues received 4 new comments:
  - #147 Authorization server metadata to enable discovery of grant/token type (1 by PieterKas)
    https://github.com/oauth-wg/oauth-identity-chaining/issues/147 
  - #143 Introduction text clarity (2 by PieterKas, bc-pi)
    https://github.com/oauth-wg/oauth-identity-chaining/issues/143 
  - #139 Updates to reflect changes to RFC7523 (jwt_privatekey attack) (1 by kook125125)
    https://github.com/oauth-wg/oauth-identity-chaining/issues/139 

  1 issues closed:
  - Introduction text clarity https://github.com/oauth-wg/oauth-identity-chaining/issues/143 

* oauth-wg/oauth-sd-jwt-vc (+1/-0/💬0)
  1 issues created:
  - Document integrity examples use wrong Base64url encoding (by Iskander508)
    https://github.com/oauth-wg/oauth-sd-jwt-vc/issues/308 

* oauth-wg/oauth-selective-disclosure-jwt (+0/-1/💬2)
  1 issues received 2 new comments:
  - #545 [KB-JWT] exp recommended? (2 by bc-pi)
    https://github.com/oauth-wg/oauth-selective-disclosure-jwt/issues/545 [has-PR] 

  1 issues closed:
  - [KB-JWT] exp recommended? https://github.com/oauth-wg/oauth-selective-disclosure-jwt/issues/545 [has-PR] 

* oauth-wg/oauth-v2-1 (+1/-0/💬1)
  1 issues created:
  - Add definitions for client_secret_basic, client_secret_post and none client authentication methods (by ThisIsMissEm)
    https://github.com/oauth-wg/oauth-v2-1/issues/210 

  1 issues received 1 new comments:
  - #210 Add definitions for client_secret_basic, client_secret_post and none client authentication methods (1 by dickhardt)
    https://github.com/oauth-wg/oauth-v2-1/issues/210 



Pull requests
-------------
* oauth-wg/oauth-browser-based-apps (+1/-0/💬0)
  1 pull requests submitted:
  - Minor edits from mails (by philippederyck)
    https://github.com/oauth-wg/oauth-browser-based-apps/pull/104 

* oauth-wg/oauth-identity-chaining (+2/-1/💬0)
  2 pull requests submitted:
  - Editorial pass for consistency with the main document. (by PieterKas)
    https://github.com/oauth-wg/oauth-identity-chaining/pull/149 
  - Clarify Introductions (by PieterKas)
    https://github.com/oauth-wg/oauth-identity-chaining/pull/148 

  1 pull requests merged:
  - Clarify Introduction
    https://github.com/oauth-wg/oauth-identity-chaining/pull/148 

* oauth-wg/oauth-sd-jwt-vc (+0/-2/💬5)
  4 pull requests received 5 new comments:
  - #306 Update PID example (1 by bc-pi)
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/306 
  - #304 Clarify that private JWT claims MAY be used (1 by bc-pi)
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/304 
  - #303 ack Aaron Parecki (1 by bc-pi)
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/303 
  - #294 Make extension point for issuer key resolution more explicit (2 by bc-pi)
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/294 

  2 pull requests merged:
  - Clarify that private JWT claims MAY be used
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/304 
  - ack Aaron Parecki
    https://github.com/oauth-wg/oauth-sd-jwt-vc/pull/303 

* oauth-wg/oauth-selective-disclosure-jwt (+2/-1/💬0)
  2 pull requests submitted:
  - Terminology improvements around the phrase "non-selectively disclosable claims" and "not disclosable" (by bc-pi)
    https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/567 
  - Suggest against using extra claims/headers in the KB-JWT without a good reason (by bc-pi)
    https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/566 

  1 pull requests merged:
  - Editorial nits from secdir last call review
    https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/565 

* oauth-wg/draft-ietf-oauth-status-list (+2/-1/💬2)
  2 pull requests submitted:
  - even more nitpicks by Denis (by paulbastian)
    https://github.com/oauth-wg/draft-ietf-oauth-status-list/pull/286 
  - Add more open source implementations to the Readme (by c2bo)
    https://github.com/oauth-wg/draft-ietf-oauth-status-list/pull/285 

  1 pull requests received 2 new comments:
  - #285 Add more open source implementations to the Readme (2 by Christiantyemele, c2bo)
    https://github.com/oauth-wg/draft-ietf-oauth-status-list/pull/285 

  1 pull requests merged:
  - Add more open source implementations to the Readme
    https://github.com/oauth-wg/draft-ietf-oauth-status-list/pull/285 


Repositories tracked by this digest:
-----------------------------------
* https://github.com/oauth-wg/oauth-browser-based-apps
* https://github.com/oauth-wg/oauth-identity-chaining
* https://github.com/oauth-wg/oauth-transaction-tokens
* https://github.com/oauth-wg/oauth-sd-jwt-vc
* https://github.com/oauth-wg/draft-ietf-oauth-resource-metadata
* https://github.com/oauth-wg/oauth-cross-device-security
* https://github.com/oauth-wg/oauth-selective-disclosure-jwt
* https://github.com/oauth-wg/oauth-v2-1
* https://github.com/oauth-wg/draft-ietf-oauth-status-list
* https://github.com/oauth-wg/draft-ietf-oauth-attestation-based-client-auth


-- 
To have a summary like this sent to your list, see: https://github.com/ietf-github-services/activity-summary

[OAUTH-WG] Weekly github digest (OAuth Activity S… Repository Activity Summary Bot