Re: [OAUTH-WG] treatment of client_id for authentication and identification

["Lu, Hui-Lan (Huilan)" <[e-mail]>]

Eran Hammer-Lahav wrote:
> Added to 2.4.1:
> 
> client_secret
>                 REQUIRED. The client secret. The client MAY omit the parameter if the
> client secret
>                 is an empty string.

I would suggest rewording the above as follows:
client_secret 
	REQUIRED unless it is an empty string. The client secret.

> Added to 3.2.1:
> 
>             A public client that was not issued a client password MAY use the
>             'client_id' request parameter to identify itself when sending
>             requests to the token endpoint.

It is difficult to parse the last sentence of 3.2.1: "The security ramifications of allowing unauthenticated access by public clients to the token endpoint MUST be considered, as well as the issuance of refresh tokens to public clients, their scope, and lifetime."

I think it should be rewritten and reference relevant parts of security considerations.

Huilan