search

oauth-wg / oauth-v2-1

OAuth 2.1 is a consolidation of the core OAuth 2.0 specs
https://oauth.net/2.1/
Other
53 stars 27 forks source link

clarify "unregistered client" #42

Closed aaronpk closed 2 years ago

aaronpk commented 3 years ago

from Justin:

§2.4: We need to define what exactly an “unregistered client” is if we’re going to refer to it here. I think rewriting of §2.2 could help address a lot of this.

dickhardt commented 3 years ago

Suggested new text for 2.4

This specification does not require that clients be registered with the authorization server. However, the use of unregistered clients is beyond the scope of this specification and requires additional security analysis and review of its interoperability impact.

I don't know what Justin's suggestion for 2.2 would entail or how it would resolve.