Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions index.bs
Original file line number Diff line number Diff line change
Expand Up @@ -361,7 +361,7 @@ the verifying party MUST follow OpenID Connect Discovery 1.0 [[!OIDC-DISCOVERY]]

When a Client performs an unauthenticated request to a protected resource,
the Resource Server MUST respond with the HTTP <code>401</code> status code,
and a <code>WWW-Authenticate</code> HTTP header. See also: [[RFC9110##name-www-authenticate]]
and a <code>WWW-Authenticate</code> HTTP header. See also: [[RFC9110]](11.6.1. WWW-Authenticate)

The <code>WWW-Authenticate</code> HTTP header MUST include an <code>as_uri</code>
parameter unless the authentication scheme requires a different mechanism
Expand Down Expand Up @@ -427,7 +427,7 @@ Considerations in context of the Solid Protocol [[!SOLID-PROTOCOL]].

## TLS Requirements ## {#security-tls}

All TLS requirements outlined in [[BCP195](https://tools.ietf.org/html/bcp195)] apply to this
All TLS requirements outlined in [[BCP195]] apply to this
specification.

All tokens, Client, and User credentials MUST only be transmitted over TLS.
Expand Down Expand Up @@ -637,6 +637,11 @@ The JSON-LD context is defined as:
"href": "https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html",
"title": "User-Managed Access (UMA) 2.0 Grant for OAuth 2.0 Authorization",
"publisher": "Kantara Initiative, Inc"
},
"BCP195": {
"href": "https://www.rfc-editor.org/info/bcp195",
"title": "Best Current Practice 195",
"publisher": "IETF"
}
}
</pre>