search

oauth-wg / oauth-selective-disclosure-jwt

https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/
Other
57 stars 31 forks source link

Make a difference between the Holder which is an *application* and the individual (i.e. End-User) #482

Closed Denisthemalice closed 2 weeks ago

Denisthemalice commented 3 weeks ago

The second sentence of the second paragraph mentions:

In this model, a JWT containing many claims is issued to an intermediate party, who holds the JWT (the Holder).

In the introduction, it is important, to make the difference between the Holder, which is an application, and the individual (i.e. End-User) who is assumed to have the control of that application. The use of the word "entity" is to broad and does not capture this difference. An individual may consent to an operation that the Holder can perform. A Holder does not "consent".

Replace by:

In this model, a JWT can contain both regular claims and selectively disclosable claims that are issued to an End-User who is assumed to have the control of a Holder.