OAuth Spec Follow-Ups

[bnewbold]

Copying over specific comments and points from the OAuth spec draft for follow-up conversation.

• token revocation: both a client best-practice and something servers would need to support (must? should?) Draft OAuth Spec #326 (comment)
• native app / localhost flow follow-ups
• strict client_uri, tos_uri, policy_uri: same-origin? require iframe-able, HTTP 200 (not redirect)? Draft OAuth Spec #326 (comment)
• should we allow data: for logo_uri? Draft OAuth Spec #326 (comment)
• should the AS auth interface render account info (handle, profile avatar) if the user supplied a raw DID for login? Draft OAuth Spec #326 (comment)
• clarify role of state in param in linking overall session identifier at end of flow (?) Draft OAuth Spec #326 (comment)
• emphasis around when sub identity check is "more" important: Draft OAuth Spec #326 (comment)
• case sensitivity of some values. Draft OAuth Spec #326 (comment)
• clarify terms around loopback interface. Draft OAuth Spec #326 (comment)
• discuss importance of verifying iss response param in more places. Draft OAuth Spec #326 (comment)
• reuse of code during auth flow resulting in AS rejecting older/existing session/token: should vs must Draft OAuth Spec #326 (comment)
• Recommend that native apps do not use DNS to resolve identity during OAuth #348