3 ms·
> Why would an issuer ever let a client decide what algo to use? Right, so, why is this in the spec?
by draw_down 10y ago
> Why would an issuer ever let a client decide what algo to use?
Right, so, why is this in the spec?
- fcvarela 10y agoThe spec doesn't govern what applications can and cannot accept, it governs what contents are valid in tokens. 'None' is valid, that means my parser library will accept it, it doesn't mean my application must accept the token as valid. Example: The fact that my service has an http stack which must parse a cookie header doesn't mean my app must accept its contents as valid. There's a lot of confusion on this thread about which components should/must do what things.
- draw_down 10y agoI guess I'm missing something here because it seems like the spec includes an ability that everyone here is saying nobody should ever use. Seems useless, by definition!