Code change:
The following example is the decoded header and payload of a JWT meeting the processing rules as defined above. <ins> 4.4. To validate an HTTP request which contains the client attestation headers, the receiving server MUST ensure the following with regard to a received HTTP request: There is precisely one OAuth-Client-Attestation HTTP request header field, where its value is a single well-formed JWT conforming to the syntax outlined in []{client-attestation-jwt}. There is precisely one OAuth-Client-Attestation-PoP HTTP request header field, where its value is a single well-formed JWT conforming to the syntax outlined in []{client-attestation-pop- jwt}. The signature of the Client Attestation PoP JWT obtained from the OAuth-Client-Attestation-PoP HTTP header verifies with the public key contained in the "cnf" claim of the Client Attestation JWT obtained from the OAuth-Client-Attestation HTTP header. </ins> 5. <del> 5.1. </del> <ins> While usage of the the client attestation mechanism defined by this draft can be used in a variety of different HTTP requests to different endpoints, usage with token endpoint as defined by RFC6749 has particular additional considerations outlined below. The authorization server MUST perform all of the checks outlined in checking-http-requests-with-client-attestations for a received access token request which is making use of the client attestation mechanism as defined by this draft. The following example demonstrates usage of the client attestation mechanism in an access token request (with extra line breaks for display purposes only): 6. 6.1. </ins> Implementers should be aware that the design of this authentication <del> mechanism deliberately allows for a client instance to re-use a </del> <ins> mechanism deliberately allows for a Client Instance to re-use a </ins> single Client Attestation JWT in multiple interactions/requests with an authorization server, whilst producing a fresh Client Attestation PoP JWT.  Client deployments should consider this when determining the validity period for issued Client Attestation JWTs as this <del> ultimately controls how long a client instance can re-use a single </del> <ins> ultimately controls how long a Client Instance can re-use a single </ins> Client Attestation JWT. <del> 5.2. </del> <ins> 6.2. </ins> Authorization servers issuing a refresh token in response to a token <del> request using the "urn:ietf:params:oauth:client-assertion-type:jwt- client-attestation" client authentication method MUST bind the refresh token to the client instance, and NOT just the client as specified in section 6 RFC6749.  To prove this binding, the client instance MUST authenticate itself to the authorization server when refreshing an access token using the "urn:ietf:params:oauth:client- assertion-type:jwt-client-attestation" authentication method.  The client MUST also use the same key that was present in the "cnf" claim of the client attestation that was used for client authentication when the refresh token was issued. 5.3. </del> <ins> request using the client attestation mechanism as defined by this draft MUST bind the refresh token to the Client Instance, and NOT just the client as specified in section 6 RFC6749.  To prove this binding, the Client Instance MUST use the client attestation mechanism when refreshing an access token.  The client MUST also use the same key that was present in the "cnf" claim of the client attestation that was used when the refresh token was issued. 6.2.1. Because the Client Attestation and Client Attestation PoP are communicated using HTTP headers, implementers should consider that web servers may have a default maximum HTTP header size configured which could be too low to allow conveying a Client Attestation and or Client Attestation PoP in an HTTP request.  It should be noted, that this limit is not given by the HTTP RFC9112, but instead web server implementations commonly set a default maximum size for HTTP headers. As of 2024, typical limits for modern web servers configure maximum HTTP headers as 8 kB or more as a default.  ## Rotation of Client Instance Key </ins> This specification does not provide a mechanism to rotate the Client Instance Key in the Client Attestation JWT's "cnf" claim.  If the

Related discussion:
text: W.r.t other aspects of the client attestation or client attestation pop being too big for an HTTP header could you elaborate on what you see as the contents of your attestation NAME Because IIUC you perhaps want to use the client attestation to convey all client metadata? If that is the case IMO the client attestation isn't for this purpose, client metadata should continue to be communicated outside of these attestations with the pre-existing mechanisms we already have defined. Finally even if we did begin to encroach on header payload limits with a client attestation, we aren't talking about hard limits here, rather just the default maximums that common web server platforms have configured, which can always be adjusted.
there some point for clarification assertion weight: a client assertion may have a x5c or an openid federation trust chain within its JWT header. This is an issuer's choice, allowed by RFC 7515 that might be not supported by httpd maximum header body size, that's a deployment/configuration choice that might be different within different domains. chain length: it could be assumed that a chain may not exceed 2 or 3 certificate breaks. This depends on the number of intermediates, an aspect that falls outside the technical specification and is determined by the federation's topology and composition. client metadata: we have some required claims in the wallet attestations and the possibility to include any other custom claim or any other claims pertaining the wallet capabilities or anything else related to the trust framework. My comment is not related to assertion payload, but to the previous point 1 and 2. However, the payload also impacts in the assertion weight, as pointed out at point 1. The missing point concerns the processing of multiple DPoP tokens within the same request. Handling multiple DPoP tokens necessitates a loop to identify the one that matches a specific assertion. This introduces additional computational and development efforts not present in the current approach (WA~WA-POP), which directly associates an assertion with its proof of possession (PoP), facilitating a straightforward and efficient identification of matching pairs.
Ok great so do we agree that this isn't an issue because servers are freely able to re-configure the max header size based on their application? Because it isn't a hard limit.
Understood but based on the above point is this actually an issue if the limit on header size isn't a hard limit?