Draft: draft-ietf-gnap-core-protocol

Commentary: fixed some typos fixed a broken reference HTTP -HTTP to keep it consistent not sure if it is actually supposed to be " Key - Bound Token Access Tokens " 
 Deploy Preview for gnap - core - protocol - editors - draft ready ! Built Explore the source changes : Inspect the deploy log : Browse the preview :
Paragraph (version A):
The client instance request.  The client instance does not send
any interactions modes to the server, indicating that it does not
expect to interact with the RO.  The client instance can also
signal which RO it requires authorization from, if known, by using
the request-user.
Paragraph (version B):
The client instance request.  The client instance does not send
any interaction modes to the server, indicating that it does not
expect to interact with the RO.  The client instance can also
signal which RO it requires authorization from, if known, by using
the request-user.
Paragraph (version A):
In this example flow, the AS policy allows the client instance to
make a call on its own behalf, without the need for a RO to be
involved at runtime to approve the decision.  Since there is no
explicit RO, the client instance does not interact with an RO.
Paragraph (version A):
The client instance request.  The client instance does not send
any interactions modes to the server.
Paragraph (version B):
In this example flow, the AS policy allows the client instance to
make a call on its own behalf, without the need for an RO to be
involved at runtime to approve the decision.  Since there is no
explicit RO, the client instance does not interact with an RO.
Paragraph (version B):
The client instance request.  The client instance does not send
any interaction modes to the server.
Paragraph (version A):
In GNAP, key-bound access tokens are the default due to their higher
security properties.  While bearer tokens can be used in GNAP, their
use should be limited onto to cases where the simplicity benefits
outweigh the significant security downsides.
Paragraph (version B):
In GNAP, key-bound access tokens are the default due to their higher
security properties.  While bearer tokens can be used in GNAP, their
use should be limited to cases where the simplicity benefits outweigh
the significant security downsides.
Paragraph (version A):
The RS also needs to ensure that a sufficient portions of the message
are covered by the signature.  Any items outside the signature could
still affect the API's processing decisions, but these items would
not be strongly bound to the token presentation.  As such, an
attacker could capture a valid request, then manipulate portions of
the request outside of the signature envelope in order to cause
unwanted actions at the protected API.
Paragraph (version B):
The RS also needs to ensure that sufficient portions of the message
are covered by the signature.  Any items outside the signature could
still affect the API's processing decisions, but these items would
not be strongly bound to the token presentation.  As such, an
attacker could capture a valid request, then manipulate portions of
the request outside of the signature envelope in order to cause
unwanted actions at the protected API.
Paragraph (version A):
Most information passed through the web-browser is susceptible to
interception and possible manipulation by elements within the browser
such as scripts loaded within pages.  Information in the URL is
exposed through browser and server logs, and can also leak to other
parties through HTTP "Referrer" headers.
Paragraph (version B):
Most information passed through the web-browser is susceptible to
interception and possible manipulation by elements within the browser
such as scripts loaded within pages.  Information in the URL is
exposed through browser and server logs, and can also leak to other
parties through HTTP "Referer" headers.
Paragraph (version A):
example, if the request is a grant request [40], the AS needs to
compare the TLS client certificate presented at the TLS layer to the
key identified in the request body itself (either by value or through
a referenced identifier).
Paragraph (version B):
example, if the request is a request, the AS needs to compare the TLS
client certificate presented at the TLS layer to the key identified
in the request body itself (either by value or through a referenced
identifier).
Paragraph (version A):
The authorization server is expected to store subject identifiers for
user indefinitely, in order to be able to include them in the
responses to clients.  The authorization server is also expected to
store client key identifiers associated with display information
about the client such as its name and logo.
Paragraph (version B):
The authorization server is expected to store subject identifiers for
users indefinitely, in order to be able to include them in the
responses to clients.  The authorization server is also expected to
store client key identifiers associated with display information
about the client such as its name and logo.