2 ms·
I don’t know what else to say - maybe the macaroonjs documentation is wrong? Full quote: > nothing stops discharge macaroons from containing embedded first- or
by jiofih 7y ago
I don’t know what else to say - maybe the macaroonjs documentation is wrong? Full quote:
> nothing stops discharge macaroons from containing embedded first- or third-party caveats for the verifier to consider during verification.
So the user requests discharge tokens on his own, but the discharge tokens have to be verified by _my_ server and might contains nested third-party caveats which I’ll have to verify.
- arnarbi 7y agoIf the discharge has another 3p caveat, then generally you'd have to get that discharged also before sending it to a server. Either way, in each deployment a server supports a set of caveats that makes sense and rejects others. Or that's the intention of the original idea (I'm an author of the paper). I can't speak for macaroonjs specifically.