<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hmm,<div class=""><br class=""><div class=""><div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On 21 Apr 2020, at 07:56, Roland Hedberg via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">If we use signed request objects, do we mandate it for all authorization requests or just for the first one.</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">If one uses explicit dynamic registration you do the registration and then you do authorization requests </div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">using any of the available methods until the registration runs out.</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">Using the same ‘model’ for automatic client registration you would only have to use a signed request object</div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">when you needed to ‘register’.</div></div></blockquote><br class=""></div><div class="">From the clients point of view, would most people choose not to track the state and hence always use signed requests if they’re doing automatic registration? (Not to mention that I’m sure registrations are at some point likely to get lost without running out?)</div><div class=""><br class=""></div><div class="">If you’ve already got them implemented and working, is there ever a downside to sending signed requests?</div><div class=""><br class=""></div><div class="">(That doesn’t directly answer the question of whether the server should mandate it though - if the security architecture is generally happy with unsigned requests I can’t see a reason to strongly mandate it at the server side.)</div><div class=""><br class=""></div></div></div></blockquote><div><br class=""></div><div><br class=""></div><div><div class="">It would seem my reception on openid-specs-ab is patchy but I’m reminded of my original comments during the Federation draft review:</div><div class=""><a href="http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20191104/007586.html" class="">http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20191104/007586.html</a></div><div class=""><br class=""></div><div class="">Not sure why Mailman/Pipermail has seen fit to censor me but nonetheless I did flag the “how to verify parties”.</div></div><div><br class=""></div><div><br class=""></div></div></div></div></body></html>