Skip to content

Add Accept header requirement when fetching Client Metadata #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ThisIsMissEm wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add Accept header requirement when fetching Client Metadata #51

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion draft-parecki-oauth-client-id-metadata-document.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,8 @@ the client to the user in an authorization consent screen, for example the
client name and logo.

The authorization server SHOULD fetch the document indicated by the `client_id`
to retrieve the client registration information.
to retrieve the client registration information. The Authorization Server MUST
Copy link

@OR13 OR13 Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why MUST? Typically a server can ignore the accept header and return whatever it wants... perhaps it is better to specify this as:

When the client_id is an HTTP Resource identifier, the Client ID Metadata Document Service MUST respond with a Content-Type header of application/json.

Also not sure if this fetching is supposed to work over protocols that do not support headers.

Copy link
Contributor Author

@ThisIsMissEm ThisIsMissEm Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a MUST for the reasons noted in #30 — the CIMD Service is also entirely optional. Having the AS send the Accept header, even if the server hosting the CIMD ignores it, allows at least for servers to go "nah, we really don't accept that request" and allow for early termination.

Copy link
Contributor Author

@ThisIsMissEm ThisIsMissEm Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We also already have language around the response content-type in the document.

send an `Accept` header of `application/json` when fetching the client metadata.

## Client Metadata

Expand Down