Add Accept header requirement when fetching Client Metadata #51
Conversation
|
|
||
| The authorization server SHOULD fetch the document indicated by the `client_id` | ||
| to retrieve the client registration information. | ||
| to retrieve the client registration information. The Authorization Server MUST |
There was a problem hiding this comment.
why MUST? Typically a server can ignore the accept header and return whatever it wants... perhaps it is better to specify this as:
When the client_id is an HTTP Resource identifier, the Client ID Metadata Document Service MUST respond with a Content-Type header of application/json.
Also not sure if this fetching is supposed to work over protocols that do not support headers.
There was a problem hiding this comment.
It's a MUST for the reasons noted in #30 — the CIMD Service is also entirely optional. Having the AS send the Accept header, even if the server hosting the CIMD ignores it, allows at least for servers to go "nah, we really don't accept that request" and allow for early termination.
There was a problem hiding this comment.
We also already have language around the response content-type in the document.
3 participants
This was noted in #30 (comment)
This pull request will conflict with #46
Is there any RFC we should specifically reference here with regards to the Accept header?