Re: [OAUTH-WG] swapping a jwsreq/JAR JWT for a client authentication JWT

Why not use a typ header as suggested by the JWT BCP?

———
Dominick Baier

On 22. July 2020 at 17:37:41, Brian Campbell (
bcampbell=40pingidentity.com@dmarc.ietf.org) wrote:

The TL;DR here is a somewhat tentative suggestion that a brief security
consideration be added to
https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/
<https://datatracker..ietf.org/doc/draft-ietf-oauth-jwsreq/> that prohibits
the inclusion of a 'sub' claim containing the client id value in the
request object JWT so as to prevent the request object JWT (which is
exposed to the user agent) from being erroneously accepted as a valid JWT
for client authentication.

Some more details and the discussion that led to this here email can be
found at https://github.com/oauthstuff/draft-oauth-par/issues/41

*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged
material for the sole use of the intended recipient(s). Any review, use,
distribution or disclosure by others is strictly prohibited..  If you have
received this communication in error, please notify the sender immediately
by e-mail and delete the message and any file attachments from your
computer. Thank you.*_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth