A public app can still keep its token to itself
06An app without a registered login credential can prove it holds a particular key. Keep that distinction when it asks to replace an old access token.
No registered OAuth login credential identifies this app. It can still prove possession of its own key.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The original certificate proof matches the server’s chosen refresh binding.
Key idea: Possession proof can bind a token without authenticating the OAuth client identity.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
Possession proof can bind a token without authenticating the OAuth client identity.
These reference examples may differ from the selected experiment.
- Public clients can use certificate-bound tokens independently of mTLS OAuth client authentication. The AS does not treat the certificate as a registered OAuth client credential.
- For public clients, refresh-token certificate binding is SHOULD, with implementation details left to the server. This example can deliberately omit that recommendation; it is not a universal MUST.
- Confidential clients must authenticate when refreshing; §7.1 describes indirect binding via client_id and certificate authentication. The selected public-client policy is not that confidential-client rule.
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.