search

aaronpk / oauth-first-party-apps

https://datatracker.ietf.org/doc/html/draft-parecki-oauth-first-party-apps
Other
9 stars 7 forks source link

auth_session in a successful token response #76

Closed yaronf closed 1 week ago

yaronf commented 3 months ago

Sec. 6.1 (in particular the example), what is the meaning of a response with an access token, a refresh token as well as an auth_session, what is the client expected to do? How should it use the auth_session?

PieterKas commented 2 months ago

The auth_session should be cached by the client in case it is needed for the stepu-up authentication flow as described in the Appendix (section A.7).