Something like this [0]. The point would be to force clients to deliberately circumvent the restrictions, which I believe would give them more standing to go af

Something like this [0]. The point would be to force clients to deliberately circumvent the restrictions, which I believe would give them more standing to go after 3rd party clients that attempt this. Worth noting that most browsers don’t support token binding yet, but this has been in the works for awhile, so I’m mentioning it here for illustrative purposes. They could theoretically implement something less airtight but with the same general goal. - [0] https://datatracker.ietf.org/doc/html/rfc8473 https://datatracker.ietf.org/doc/html/rfc8473