<div dir="ltr">Hi,<div><br></div><div>I would say that the introspection endpoint must authenticate the client.</div><div><br></div><div>Extract from the RFC 7662 "OAuth 2.0 Token Introspection"<br><br class="gmail-Apple-interchange-newline">
</div><div><br></div><div>
<pre class="gmail-newpage" style="font-size:13.3333px;margin-top:0px;margin-bottom:0px;color:rgb(0,0,0);font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">To prevent token scanning attacks, the endpoint MUST also require
some form of authorization to access this endpoint, such as client
authentication as described in OAuth 2.0</pre>
<br></div><div>MitreID Connect, with its checkbox "introspection" allow a client or not to use such endpoint.</div><div><br></div><div>Regards,</div><div><br></div><div>Yannick</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 6, 2018 at 9:52 AM, Marco Descher <span dir="ltr"><<a href="mailto:descher@medevit.at" target="_blank">descher@medevit.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hy List,<br>
<br>
I am co-hosting openid with another application acting as resource<br>
provider. Now I have to validate the tokens presented.<br>
<br>
Is it possible to configure OpenID s.t. I do not need any client and<br>
authentication to query /introspect with requests originating from<br>
localhost?<br>
<br>
Thanks,<br>
marco<br>
<br>
______________________________<wbr>_________________<br>
mitreid-connect mailing list<br>
<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a><br>
<a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect" rel="noreferrer" target="_blank">http://mailman.mit.edu/<wbr>mailman/listinfo/mitreid-<wbr>connect</a><br>
</blockquote></div><br></div>