elf-pavlik
commented
2 years ago My first question is therefore to clarify that this is indeed a change, and maybe indicate that the video intro's do no longer contain all the latest information.
Videos include some outdated information, probably we should hint that in README
Secondly, and more importantly i.m.o., this seems to entail that the Authorization Agent needs some kind of back-end for this mechanism to work. Up till now, I had always seen that agent as a front-end only application. Is this not the case?
Actually, Authorization Agent is intended to be a server-side service. Generating access grants from access consents. Subscribing to agent registrations on behalf of the grantee, all that makes more sense to run as server-side service.
woutermont
I believe the video intro's to the interop spec describe a "security by obscurity" mechanism for application registration discovery using hashed client IDs. However, in the current draft, I can no longer find this idea, and discovery seems to happen via a header from the Authorization Agent.
My first question is therefore to clarify that this is indeed a change, and maybe indicate that the video intro's do no longer contain all the latest information.
Secondly, and more importantly i.m.o., this seems to entail that the Authorization Agent needs some kind of back-end for this mechanism to work. Up till now, I had always seen that agent as a front-end only application. Is this not the case?