From 91ce788fe3c74b69b72f19124eac54f2469b445c Mon Sep 17 00:00:00 2001 From: ID Bot Date: Thu, 13 Feb 2025 20:04:10 +0000 Subject: [PATCH] Script updating gh-pages from 9296b02. [ci skip] --- .../draft-ietf-oauth-transaction-tokens.html | 2 +- .../draft-ietf-oauth-transaction-tokens.txt | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.html b/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.html index 3817613..be4ecf1 100644 --- a/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.html +++ b/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.html @@ -2286,7 +2286,7 @@

9.8. Transaction Token Service Discovery

A workload may use various mechanisms to determine which Transaction Token Service to interact with. Workloads MUST retrieve configuration information from a trusted source to minimize the risk of a threat actor providing malicious configuration data that points to a Transaction Token Service under it's control. Such a service could be used to collect Access Tokens sent as part of the Transaction Token Request message.

-

To mitigate this risk, workloads SHOULD authenticate the service providing the configuration information and verify the integrity of the configuration information. This ensures that no unauthorized entity can insert or alter configuration data. The workload SHOULDuse Transport Layer Security (TLS) to authenticate the endpoint and secure the communication channel. Additionally, application-layer signatures or message authentication codes MAY be used to detect any tampering with the configuration information.

+

To mitigate this risk, workloads SHOULD authenticate the service providing the configuration information and verify the integrity of the configuration information. This ensures that no unauthorized entity can insert or alter configuration data. The workload SHOULD use Transport Layer Security (TLS) to authenticate the endpoint and secure the communication channel. Additionally, application-layer signatures or message authentication codes MAY be used to detect any tampering with the configuration information.

diff --git a/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.txt b/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.txt index 47ae770..05f3eca 100644 --- a/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.txt +++ b/PieterKas-patch-1/draft-ietf-oauth-transaction-tokens.txt @@ -1072,11 +1072,11 @@ Table of Contents To mitigate this risk, workloads SHOULD authenticate the service providing the configuration information and verify the integrity of the configuration information. This ensures that no unauthorized - entity can insert or alter configuration data. The workload - SHOULDuse Transport Layer Security (TLS) to authenticate the endpoint - and secure the communication channel. Additionally, application- - layer signatures or message authentication codes MAY be used to - detect any tampering with the configuration information. + entity can insert or alter configuration data. The workload SHOULD + use Transport Layer Security (TLS) to authenticate the endpoint and + secure the communication channel. Additionally, application-layer + signatures or message authentication codes MAY be used to detect any + tampering with the configuration information. 9.9. Workload Configuration Protection