Adds an iss parameter to the authorization response so the client can tell which authorization server answered, a countermeasure to mix-up attacks.
No explainer written for this spec yet. The summary, relations and documented support below are maintained.
Adds an iss parameter to the authorization response so the client can tell which authorization server answered, a countermeasure to mix-up attacks.
flowchart LR s_iss_authz_response["Authorization Server Issuer Identification"] s_oauth2["OAuth 2.0"] style s_iss_authz_response stroke-width:3px s_iss_authz_response -->|Extends| s_oauth2
Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.
No sourced support entries collected yet. This says nothing about how widely it is used.
Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.
openid/claims-aggregation: 3 new commits on the default branch
The commits are merges of PR #39 (spec-edits), #40 (claims-aggregation-trust-model) and #41 (rfc9207-mix-up-defense). Only branch names are available, with no diff or PR body, so the actual text changes are unknown. The branch names suggest a trust model section and use of RFC 9207 issuer identification against mix-up attacks.