Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: [UNVERIFIED SENDER] Re: [UNVERIFIED SENDER] Re: PAR metadata

2020-01-08 Thread Richard Backman, Annabelle
I almost included text to that effect, but thought it was getting too wordy. However your suggestion is simple and concise. +1 Given all of this discussion, we should include a section on request validation in Security Considerations, to provide some context on what might be validated when and

Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: [UNVERIFIED SENDER] Re: [UNVERIFIED SENDER] Re: PAR metadata

2020-01-10 Thread Justin Richer
+1 to this being a security consideration — Justin > On Jan 8, 2020, at 3:46 PM, Richard Backman, Annabelle > wrote: > > I almost included text to that effect, but thought it was getting too wordy. > However your suggestion is simple and concise. +1 > > Given all of this discussion, we shou