Issues

• Match RFC8414 definition of authorization server issuer and metadata document

  indieweb/indieauth#141 · Filter by author aaronpk opened on Sep 19, 2026
  1

• Is it legal to omit the access_token?

  indieweb/indieauth#140 · Filter by author FenTiger opened on May 25, 2025
  1

• Should indieauth-metadata be discoverable by DNS?

  indieweb/indieauth#134 · Filter by author samuelgoto opened on May 23, 2024
  3

• Usage of the Me Parameter in the Access Token Response

  indieweb/indieauth#132 · Filter by author dshanske opened on Dec 17, 2023
  3

• Add Extension Registry URL to spec.

  indieweb/indieauth#130 · Filter by author dshanske opened on Nov 11, 2023
  1

• Note that the Issuer Identifier URL Should Have the Metadata Headers

  indieweb/indieauth#128 · Filter by author dshanske opened on Nov 7, 2023
  9

• Add Microsub as a conformance class

  indieweb/indieauth#125 · Filter by author omz13 opened on Oct 5, 2023

• Add Device Flow / Device Authorization Grant

  indieweb/indieauth#124 · Filter by author omz13 opened on Oct 4, 2023
  2

• Require explicitly specifying redirect_uri instead of allowing same-host URIs by default?

  indieweb/indieauth#122 · Filter by author saschanaz opened on Apr 9, 2023
  1

• Include Cache-Control and Pragma headers in token exchange response example

  indieweb/indieauth#117 · Filter by author barnabywalters opened on Oct 23, 2022
  2

• Text improvement for §6.2 Access Token Verification Response

  indieweb/indieauth#115 · Filter by author gRegorLove opened on May 16, 2022

• ticketing + ac-obo

  ticketing extension
  indieweb/indieauth#113 · Filter by author omz13 opened on Apr 4, 2022

• Expressly Note a TLS/HTTPS requirement

  indieweb/indieauth#103 · Filter by author dshanske opened on Oct 18, 2021
  2

• Issuing Access Tokens for Introspection

  indieweb/indieauth#99 · Filter by author dshanske opened on Oct 2, 2021
  7

• Extension to Allow Clients to Get Tokens Secured by Ticket

  ticketing extension
  indieweb/indieauth#88 · Filter by author dshanske opened on Aug 18, 2021
  5

• Standard mechanism for requesting a ticket auth ticket grant?

  ticketing extension
  indieweb/indieauth#87 · Filter by author fluffy-critter opened on Jul 11, 2021
  11

• Do we need to add client_id to ticket auth requests?

  ticketing extension
  indieweb/indieauth#85 · Filter by author aaronpk opened on Jul 10, 2021
  3

• Should a token grant access to anything more specific than the specified resource?

  ticketing extension
  indieweb/indieauth#83 · Filter by author aaronpk opened on Jul 8, 2021
  1

• Adopt Resource Indicators or similar system to limit token access to resources

  revisit later
  indieweb/indieauth#82 · Filter by author dshanske opened on Jul 5, 2021
  7

• Clarify what an AS should display if no app information was discovered at the client ID URL

  indieweb/indieauth#64 · Filter by author aaronpk opened on Oct 30, 2020
  1

• IndieAuth needs non-normative Privacy Threat Model documentation

  indieweb/indieauth#63 · Filter by author tantek opened on Oct 12, 2020

• Adopt Pushed Authorization Requests

  revisit later
  indieweb/indieauth#40 · Filter by author aaronpk opened on Jul 23, 2020
  5

• Document URL update procedures

  indieweb/indieauth#34 · Filter by author brandonkal opened on Oct 19, 2019

• Which WWW-Authenticate header to use?

  indieweb/indieauth#32 · Filter by author sebsel opened on Jun 6, 2019
  1

• Write up threat analysis

  indieweb/indieauth#29 · Filter by author aaronpk opened on Oct 17, 2018
  1