Skip to content

Commit

Permalink
Script updating gh-pages from 744111c. [ci skip]
Browse files Browse the repository at this point in the history
  • Loading branch information
ID Bot committed May 23, 2024
1 parent 3f91271 commit b0823c5
Show file tree
Hide file tree
Showing 2 changed files with 60 additions and 68 deletions.
91 changes: 41 additions & 50 deletions draft-parecki-oauth-client-id-metadata-document.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1143,13 +1143,16 @@ <h2 id="name-copyright-notice">
<p id="section-toc.1-1.4.1"><a href="#section-4" class="auto internal xref">4</a>.  <a href="#name-client-information-discover" class="internal xref">Client Information Discovery</a></p>
<ul class="compact toc ulBare ulEmpty">
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.1">
<p id="section-toc.1-1.4.2.1.1"><a href="#section-4.1" class="auto internal xref">4.1</a>.  <a href="#name-metadata-discovery-errors" class="internal xref">Metadata Discovery Errors</a></p>
<p id="section-toc.1-1.4.2.1.1"><a href="#section-4.1" class="auto internal xref">4.1</a>.  <a href="#name-client-metadata" class="internal xref">Client Metadata</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.2">
<p id="section-toc.1-1.4.2.2.1"><a href="#section-4.2" class="auto internal xref">4.2</a>.  <a href="#name-redirect-url-registration" class="internal xref">Redirect URL Registration</a></p>
<p id="section-toc.1-1.4.2.2.1"><a href="#section-4.2" class="auto internal xref">4.2</a>.  <a href="#name-metadata-discovery-errors" class="internal xref">Metadata Discovery Errors</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.3">
<p id="section-toc.1-1.4.2.3.1"><a href="#section-4.3" class="auto internal xref">4.3</a>.  <a href="#name-metadata-caching" class="internal xref">Metadata Caching</a></p>
<p id="section-toc.1-1.4.2.3.1"><a href="#section-4.3" class="auto internal xref">4.3</a>.  <a href="#name-redirect-url-registration" class="internal xref">Redirect URL Registration</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.4">
<p id="section-toc.1-1.4.2.4.1"><a href="#section-4.4" class="auto internal xref">4.4</a>.  <a href="#name-metadata-caching" class="internal xref">Metadata Caching</a></p>
</li>
</ul>
</li>
Expand All @@ -1171,15 +1174,7 @@ <h2 id="name-copyright-notice">
<p id="section-toc.1-1.6.1"><a href="#section-6" class="auto internal xref">6</a>.  <a href="#name-iana-considerations" class="internal xref">IANA Considerations</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7">
<p id="section-toc.1-1.7.1"><a href="#section-7" class="auto internal xref">7</a>.  <a href="#name-references" class="internal xref">References</a></p>
<ul class="compact toc ulBare ulEmpty">
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7.2.1">
<p id="section-toc.1-1.7.2.1.1"><a href="#section-7.1" class="auto internal xref">7.1</a>.  <a href="#name-normative-references" class="internal xref">Normative References</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7.2.2">
<p id="section-toc.1-1.7.2.2.1"><a href="#section-7.2" class="auto internal xref">7.2</a>.  <a href="#name-informative-references" class="internal xref">Informative References</a></p>
</li>
</ul>
<p id="section-toc.1-1.7.1"><a href="#section-7" class="auto internal xref">7</a>.  <a href="#name-normative-references" class="internal xref">Normative References</a></p>
</li>
<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.8">
<p id="section-toc.1-1.8.1"><a href="#appendix-A" class="auto internal xref"></a><a href="#name-acknowledgments" class="internal xref">Acknowledgments</a></p>
Expand Down Expand Up @@ -1252,36 +1247,46 @@ <h2 id="name-client-information-discover">
client name and logo.<a href="#section-4-1" class="pilcrow"></a></p>
<p id="section-4-2">The authorization server <span class="bcp14">SHOULD</span> fetch the document indicated by the <code>client_id</code>
to retrieve the client registration information.<a href="#section-4-2" class="pilcrow"></a></p>
<div id="metadata-discovery-errors">
<div id="client-metadata">
<section id="section-4.1">
<h3 id="name-client-metadata">
<a href="#section-4.1" class="section-number selfRef">4.1. </a><a href="#name-client-metadata" class="section-name selfRef">Client Metadata</a>
</h3>
<p id="section-4.1-1">The client metadata document URL is a JSON document containing the metadata
of the client. The client metadata values are the values defined in
OAuth Dynamic Client Registration (<span>[<a href="#RFC7591" class="cite xref">RFC7591</a>]</span>) section 2.<a href="#section-4.1-1" class="pilcrow"></a></p>
</section>
</div>
<div id="metadata-discovery-errors">
<section id="section-4.2">
<h3 id="name-metadata-discovery-errors">
<a href="#section-4.1" class="section-number selfRef">4.1. </a><a href="#name-metadata-discovery-errors" class="section-name selfRef">Metadata Discovery Errors</a>
<a href="#section-4.2" class="section-number selfRef">4.2. </a><a href="#name-metadata-discovery-errors" class="section-name selfRef">Metadata Discovery Errors</a>
</h3>
<p id="section-4.1-1">If fetching the metadata document fails, the authorization server <span class="bcp14">MAY</span> abort the
authorization request, or continue with the information it has available.<a href="#section-4.1-1" class="pilcrow"></a></p>
<p id="section-4.2-1">If fetching the metadata document fails, the authorization server <span class="bcp14">MAY</span> abort the
authorization request, or continue with the information it has available.<a href="#section-4.2-1" class="pilcrow"></a></p>
</section>
</div>
<div id="redirect-url-registration">
<section id="section-4.2">
<section id="section-4.3">
<h3 id="name-redirect-url-registration">
<a href="#section-4.2" class="section-number selfRef">4.2. </a><a href="#name-redirect-url-registration" class="section-name selfRef">Redirect URL Registration</a>
<a href="#section-4.3" class="section-number selfRef">4.3. </a><a href="#name-redirect-url-registration" class="section-name selfRef">Redirect URL Registration</a>
</h3>
<p id="section-4.2-1">According to <span>[<a href="#I-D.draft-ietf-oauth-security-topics" class="cite xref">I-D.draft-ietf-oauth-security-topics</a>]</span>, the authorization server
<p id="section-4.3-1">According to <span>[<a href="#I-D.draft-ietf-oauth-security-topics" class="cite xref">I-D.draft-ietf-oauth-security-topics</a>]</span>, the authorization server
<span class="bcp14">MUST</span> require registration of redirect URLs, and compare redirect URLs with
exact string matching. This client information discovery establishes a
registered redirect URL with the authorization server which is used when
comparing the redirect URL in an authorization request against the registered
redirect URLs.<a href="#section-4.2-1" class="pilcrow"></a></p>
redirect URLs.<a href="#section-4.3-1" class="pilcrow"></a></p>
</section>
</div>
<div id="metadata-caching">
<section id="section-4.3">
<section id="section-4.4">
<h3 id="name-metadata-caching">
<a href="#section-4.3" class="section-number selfRef">4.3. </a><a href="#name-metadata-caching" class="section-name selfRef">Metadata Caching</a>
<a href="#section-4.4" class="section-number selfRef">4.4. </a><a href="#name-metadata-caching" class="section-name selfRef">Metadata Caching</a>
</h3>
<p id="section-4.3-1">The authorization server <span class="bcp14">MAY</span> cache the client information it discovers at the
metadata document URL.<a href="#section-4.3-1" class="pilcrow"></a></p>
<p id="section-4.3-2">TBD: recommend a cache lifetime? considerations about stale data?<a href="#section-4.3-2" class="pilcrow"></a></p>
<p id="section-4.4-1">The authorization server <span class="bcp14">MAY</span> cache the client information it discovers at the
metadata document URL.<a href="#section-4.4-1" class="pilcrow"></a></p>
<p id="section-4.4-2">TBD: recommend a cache lifetime? considerations about stale data?<a href="#section-4.4-2" class="pilcrow"></a></p>
</section>
</div>
</section>
Expand Down Expand Up @@ -1345,53 +1350,39 @@ <h2 id="name-iana-considerations">
<p id="section-6-1">This document has no IANA actions.<a href="#section-6-1" class="pilcrow"></a></p>
</section>
</div>
<div id="sec-normative-references">
<section id="section-7">
<h2 id="name-references">
<a href="#section-7" class="section-number selfRef">7. </a><a href="#name-references" class="section-name selfRef">References</a>
<h2 id="name-normative-references">
<a href="#section-7" class="section-number selfRef">7. </a><a href="#name-normative-references" class="section-name selfRef">Normative References</a>
</h2>
<div id="sec-normative-references">
<section id="section-7.1">
<h3 id="name-normative-references">
<a href="#section-7.1" class="section-number selfRef">7.1. </a><a href="#name-normative-references" class="section-name selfRef">Normative References</a>
</h3>
<dl class="references">
<dt id="I-D.draft-ietf-oauth-security-topics">[I-D.draft-ietf-oauth-security-topics]</dt>
<dd>
<dd>
<span class="refAuthor">Lodderstedt, T.</span>, <span class="refAuthor">Bradley, J.</span>, <span class="refAuthor">Labunets, A.</span>, and <span class="refAuthor">D. Fett</span>, <span class="refTitle">"OAuth 2.0 Security Best Current Practice"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-ietf-oauth-security-topics-27</span>, <time datetime="2024-05-07" class="refDate">7 May 2024</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-27">https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-27</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC2119">[RFC2119]</dt>
<dd>
<dd>
<span class="refAuthor">Bradner, S.</span>, <span class="refTitle">"Key words for use in RFCs to Indicate Requirement Levels"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 2119</span>, <span class="seriesInfo">DOI 10.17487/RFC2119</span>, <time datetime="1997-03" class="refDate">March 1997</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc2119">https://www.rfc-editor.org/rfc/rfc2119</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC6749">[RFC6749]</dt>
<dd>
<dd>
<span class="refAuthor">Hardt, D., Ed.</span>, <span class="refTitle">"The OAuth 2.0 Authorization Framework"</span>, <span class="seriesInfo">RFC 6749</span>, <span class="seriesInfo">DOI 10.17487/RFC6749</span>, <time datetime="2012-10" class="refDate">October 2012</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc6749">https://www.rfc-editor.org/rfc/rfc6749</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC6819">[RFC6819]</dt>
<dd>
<span class="refAuthor">Lodderstedt, T., Ed.</span>, <span class="refAuthor">McGloin, M.</span>, and <span class="refAuthor">P. Hunt</span>, <span class="refTitle">"OAuth 2.0 Threat Model and Security Considerations"</span>, <span class="seriesInfo">RFC 6819</span>, <span class="seriesInfo">DOI 10.17487/RFC6819</span>, <time datetime="2013-01" class="refDate">January 2013</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc6819">https://www.rfc-editor.org/rfc/rfc6819</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8174">[RFC8174]</dt>
<dd>
<span class="refAuthor">Leiba, B.</span>, <span class="refTitle">"Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 8174</span>, <span class="seriesInfo">DOI 10.17487/RFC8174</span>, <time datetime="2017-05" class="refDate">May 2017</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc8174">https://www.rfc-editor.org/rfc/rfc8174</a>&gt;</span>. </dd>
<span class="refAuthor">Lodderstedt, T., Ed.</span>, <span class="refAuthor">McGloin, M.</span>, and <span class="refAuthor">P. Hunt</span>, <span class="refTitle">"OAuth 2.0 Threat Model and Security Considerations"</span>, <span class="seriesInfo">RFC 6819</span>, <span class="seriesInfo">DOI 10.17487/RFC6819</span>, <time datetime="2013-01" class="refDate">January 2013</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc6819">https://www.rfc-editor.org/rfc/rfc6819</a>&gt;</span>. </dd>
<dd class="break"></dd>
</dl>
</section>
</div>
<div id="sec-informative-references">
<section id="section-7.2">
<h3 id="name-informative-references">
<a href="#section-7.2" class="section-number selfRef">7.2. </a><a href="#name-informative-references" class="section-name selfRef">Informative References</a>
</h3>
<dl class="references">
<dt id="RFC7591">[RFC7591]</dt>
<dd>
<span class="refAuthor">Richer, J., Ed.</span>, <span class="refAuthor">Jones, M.</span>, <span class="refAuthor">Bradley, J.</span>, <span class="refAuthor">Machulak, M.</span>, and <span class="refAuthor">P. Hunt</span>, <span class="refTitle">"OAuth 2.0 Dynamic Client Registration Protocol"</span>, <span class="seriesInfo">RFC 7591</span>, <span class="seriesInfo">DOI 10.17487/RFC7591</span>, <time datetime="2015-07" class="refDate">July 2015</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc7591">https://www.rfc-editor.org/rfc/rfc7591</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8174">[RFC8174]</dt>
<dd>
<span class="refAuthor">Leiba, B.</span>, <span class="refTitle">"Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 8174</span>, <span class="seriesInfo">DOI 10.17487/RFC8174</span>, <time datetime="2017-05" class="refDate">May 2017</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc8174">https://www.rfc-editor.org/rfc/rfc8174</a>&gt;</span>. </dd>
<dd class="break"></dd>
</dl>
</section>
</div>
</section>
<div id="acknowledgments">
<section id="appendix-A">
<h2 id="name-acknowledgments">
Expand Down
37 changes: 19 additions & 18 deletions draft-parecki-oauth-client-id-metadata-document.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,17 +76,16 @@ Table of Contents
2. Conventions and Definitions
3. Client Identifier
4. Client Information Discovery
4.1. Metadata Discovery Errors
4.2. Redirect URL Registration
4.3. Metadata Caching
4.1. Client Metadata
4.2. Metadata Discovery Errors
4.3. Redirect URL Registration
4.4. Metadata Caching
5. Security Considerations
5.1. Public vs Confidential Clients
5.2. OAuth Phishing Attacks
5.3. Server Side Request Forgery (SSRF) Attacks
6. IANA Considerations
7. References
7.1. Normative References
7.2. Informative References
7. Normative References
Acknowledgments
Authors' Addresses

Expand Down Expand Up @@ -142,13 +141,19 @@ Table of Contents
The authorization server SHOULD fetch the document indicated by the
client_id to retrieve the client registration information.

4.1. Metadata Discovery Errors
4.1. Client Metadata

The client metadata document URL is a JSON document containing the
metadata of the client. The client metadata values are the values
defined in OAuth Dynamic Client Registration ([RFC7591]) section 2.

4.2. Metadata Discovery Errors

If fetching the metadata document fails, the authorization server MAY
abort the authorization request, or continue with the information it
has available.

4.2. Redirect URL Registration
4.3. Redirect URL Registration

According to [I-D.draft-ietf-oauth-security-topics], the
authorization server MUST require registration of redirect URLs, and
Expand All @@ -157,7 +162,7 @@ Table of Contents
authorization server which is used when comparing the redirect URL in
an authorization request against the registered redirect URLs.

4.3. Metadata Caching
4.4. Metadata Caching

The authorization server MAY cache the client information it
discovers at the metadata document URL.
Expand Down Expand Up @@ -228,9 +233,7 @@ Table of Contents

This document has no IANA actions.

7. References

7.1. Normative References
7. Normative References

[I-D.draft-ietf-oauth-security-topics]
Lodderstedt, T., Bradley, J., Labunets, A., and D. Fett,
Expand All @@ -254,17 +257,15 @@ Table of Contents
DOI 10.17487/RFC6819, January 2013,
<https://www.rfc-editor.org/rfc/rfc6819>.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

7.2. Informative References

[RFC7591] Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and
P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol",
RFC 7591, DOI 10.17487/RFC7591, July 2015,
<https://www.rfc-editor.org/rfc/rfc7591>.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

Acknowledgments

TODO acknowledge.
Expand Down

0 comments on commit b0823c5

Please sign in to comment.