Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: MTLS and in-browser clients using the token endpoint

2019-02-04 Thread David Waite
My understanding is that a permanent redirect would be telling the client (and any other clients getting cached results from an intermediary) to now stop using the original endpoint in perpetuity for all cases. I don’t think that is appropriate (in the general case) for an endpoint with request

Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: MTLS and in-browser clients using the token endpoint

2019-02-04 Thread Brian Campbell
Those points of confusion strike me as somewhat hypothetical or hyperbolic. But your general point is taken and your position of being anti additional metadata on this issue is noted. All of which leaves me a bit uncertain about how to proceed. There seem to be a range of opinions on this point an

Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: MTLS and in-browser clients using the token endpoint

2019-02-04 Thread Brian Campbell
Yeah, probably. On Sat, Feb 2, 2019 at 12:39 AM Neil Madden wrote: > If we go down the 307 route, shouldn’t it rather be a 308 (permanent) > redirect? It seems unnecessary for the client to keep trying the original > endpoint or have to remember cache-control/expires timeouts. > > — Neil > > On