Code change:
The following example is the decoded header and payload of a JWT meeting the processing rules as defined above. <ins> 4.4. To validate an HTTP request which contains the client attestation headers, the receiving server MUST ensure the following with regard to a received HTTP request: There is precisely one OAuth-Client-Attestation HTTP request header field, where its value is a single well-formed JWT conforming to the syntax outlined in []{client-attestation-jwt}. There is precisely one OAuth-Client-Attestation-PoP HTTP request header field, where its value is a single well-formed JWT conforming to the syntax outlined in []{client-attestation-pop- jwt}. The signature of the Client Attestation PoP JWT obtained from the OAuth-Client-Attestation-PoP HTTP header verifies with the public key contained in the "cnf" claim of the Client Attestation JWT obtained from the OAuth-Client-Attestation HTTP header. </ins> 5. <del> 5.1. </del> <ins> While usage of the the client attestation mechanism defined by this draft can be used in a variety of different HTTP requests to different endpoints, usage with token endpoint as defined by RFC6749 has particular additional considerations outlined below. The authorization server MUST perform all of the checks outlined in checking-http-requests-with-client-attestations for a received access token request which is making use of the client attestation mechanism as defined by this draft. The following example demonstrates usage of the client attestation mechanism in an access token request (with extra line breaks for display purposes only): 6. 6.1. </ins> Implementers should be aware that the design of this authentication <del> mechanism deliberately allows for a client instance to re-use a </del> <ins> mechanism deliberately allows for a Client Instance to re-use a </ins> single Client Attestation JWT in multiple interactions/requests with an authorization server, whilst producing a fresh Client Attestation PoP JWT.  Client deployments should consider this when determining the validity period for issued Client Attestation JWTs as this <del> ultimately controls how long a client instance can re-use a single </del> <ins> ultimately controls how long a Client Instance can re-use a single </ins> Client Attestation JWT. <del> 5.2. </del> <ins> 6.2. </ins> Authorization servers issuing a refresh token in response to a token <del> request using the "urn:ietf:params:oauth:client-assertion-type:jwt- client-attestation" client authentication method MUST bind the refresh token to the client instance, and NOT just the client as specified in section 6 RFC6749.  To prove this binding, the client instance MUST authenticate itself to the authorization server when refreshing an access token using the "urn:ietf:params:oauth:client- assertion-type:jwt-client-attestation" authentication method.  The client MUST also use the same key that was present in the "cnf" claim of the client attestation that was used for client authentication when the refresh token was issued. 5.3. </del> <ins> request using the client attestation mechanism as defined by this draft MUST bind the refresh token to the Client Instance, and NOT just the client as specified in section 6 RFC6749.  To prove this binding, the Client Instance MUST use the client attestation mechanism when refreshing an access token.  The client MUST also use the same key that was present in the "cnf" claim of the client attestation that was used when the refresh token was issued. 6.2.1. Because the Client Attestation and Client Attestation PoP are communicated using HTTP headers, implementers should consider that web servers may have a default maximum HTTP header size configured which could be too low to allow conveying a Client Attestation and or Client Attestation PoP in an HTTP request.  It should be noted, that this limit is not given by the HTTP RFC9112, but instead web server implementations commonly set a default maximum size for HTTP headers. As of 2024, typical limits for modern web servers configure maximum HTTP headers as 8 kB or more as a default.  ## Rotation of Client Instance Key </ins> This specification does not provide a mechanism to rotate the Client Instance Key in the Client Attestation JWT's "cnf" claim.  If the

Related discussion:
text: (please, consider that openid federation brings policy languages, trust marks and multiple protocol specific metadata) I'm worried about these aspects: loop required for parse/matching the correct DPoP when multiple DPoP are present, while WIA~WIA-POP doesn't bring this problem. What's the benefit of having this breaking change that reduce the flexibility while increasing the complexity? size limitations: Do we have to imagine to standardize something upon the assumption that a federation topology should not have more than 2 or 4 or 8 intermediates, since this decision is out of scope on this specification.
A bit off-topic for the current discussion: We need to fix the examples - they are way too long which breaks the rendering/conversion and will cause problems with the datatracker. I do believe that this is also the reason why the html file was not created.
Note that rfc9449 does not allow for multiple DPoP headers. It could maybe have been stated more clearly but is kinda implied and was absolutely the intent of the RFC overall and specific text like URL
NAME as I implied with my earlier comment, the current draft text doesn't support multiple attestations so I don't view this proposal to shift to headers as removing functionality, it appears this is a new usecase and I think we should discuss it in a seperate issue. No I dont think we do, what was identified above is that there is no size limit on headers in HTTP rather defaults that servers apply which can be adjusted, in reality web servers also apply limits to the body of an HTTP request (although often much larger then what is allocated for headers).
Discussed with NAME I will add an implementation consideration around the default size limits for HTTP headers.
NAME what about using compressed values? unfortunately this sounds like giving a solution that may bring other problems, at the same time we can consider zlib (RFC 1950) for doing this.
Something broke with linking the html rendered versions properly Rendered html: URL
It just (re)occurred to me that specs defining new HTTP headers (which the cool kids call fields nowadays) are supposed to request their registration in the . I don't want to hold up this PR for this but will create an issue from this comment so as not to lose track of it.