Workload Proof Token Binding to transport

[PieterKas]

Commenting as identity enthusiast as opposed to WIMSE co-chair

DPoP allows for inclusion of claims about the HTTP Method and URI of the recipient to avoid spurious re-use or re-purposing of the proof. Is this achieved through the aud claim, or do we need additional provisions/extensions for this in the Workload Proof Token.

[bc-pi]

It is currently (in -00) achieved partially though the aud claim, which is basically equivalent to DPoP's htu claim. In the first draft of this one, I opted for simplicity, minimalism, and the use of existing original RFC7519 defined claims where it was possible and seemed to make sense.

[yaronf]

@bc-pi So why not add the htm (HTTP method) claim with the same syntax as in RFC 9449?

[bc-pi]

I opted for simplicity, minimalism, and the use of existing original RFC7519 defined claims where it was possible and seemed to make sense

[yaronf]

I imagine the same lofty goals applied to the original DPoP, and yet htm found its way in - because it's so critical to the semantics of the message.

[bc-pi]

It was much more haphazard, if I recall correctly.