diff --git a/draft-jones-oauth-rfc7523bis.xml b/draft-jones-oauth-rfc7523bis.xml index 5f47f77..c0e1786 100644 --- a/draft-jones-oauth-rfc7523bis.xml +++ b/draft-jones-oauth-rfc7523bis.xml @@ -353,8 +353,9 @@ Authorization grant JWTs MUST be explicitly typed by using the typ header parameter value - authorization-grant+jwt. - Authorization grant JWTs not using this explicit type value + authorization-grant+jwt or + another more specific explicit type value defined by a specification profiling this specification. + Authorization grant JWTs not using the explicit type value MUST be rejected by the authorization server. @@ -394,8 +395,9 @@ Client authentication JWTs MUST be explicitly typed by using the typ header parameter value - client-authentication+jwt. - Client authentication JWTs not using this explicit type value + client-authentication+jwt + another more specific explicit type value defined by a specification profiling this specification. + Client authentication JWTs not using the explicit type value MUST be rejected by the authorization server. If the client JWT is not valid, the