gRegorI'm working on IndieAuth token introspection and wondering best way to add authorization, since it's a MUST in the spec. https://www.rfc-editor.org/rfc/rfc7662#section-2.1 gives an example "using a separate OAuth 2 access token" but I'm not sure how clients would get that separate token?
gRegorWell hmm. I'd like this ProcessWire module to theoretically support using different endpoints, but w/o knowing how to do the authz, may have to ship it without that for now
gRegorThere's a small text change that could help with that: 6.2 Access Token Verification Response has "Clients SHOULD ignore parameters they don't recognize."
[snarfed]I've never even heard it called a "scanning" attack. generally brute force. regardless, agreed, very rarely never a meaningful vector in any threat model
jamietannaGWG gRegor, currently token introspection isn't auth'd, but I'll be moving to something like private_key_jwt instead of longer-lived credentials like basic auth, but basic auth with a per-client credential works too :)
jamietannaThe reason we'd want it is to be able to let your Micropub server verify tokens - in an out-of-the-box OAuth2 client - instead of using the old IndieAuth token endpoint (with a GET) which was being seen as used by Micropub Clients and Micropub Servers, which wasn't correct
nixer, cybi, tetov-irc and mro_ joined the channel
[tantek]GWG, while a bit more than a presence-query, could you consider instead going ahead and asking the community "how wrong things might go", and if you want my input in particular, feel free to @-name me afterwards as a "^" or "cc"
[tantek]Hmm, I read that and I don't see a clear problem statement of what problem you’re trying to solve, so I'd suggest doing that first (writing up specifically what problem you're trying to solve, and if you're not sure, describing maybe an "ideal" in terms of user-actions and expected results — purely in terms of user actions, with zero mention of protocols)
[tantek]describing the problem properly is often a big part of figuring it out, and I can't really help you with that, you have to pick apart and keep asking yourself why to understand what that is
GWG[tantek]: Example is that person X, let's say me...wants to do a photo challenge or something similar. So, I want people to post on their own sites... but I want someone following to be able to subscribe to their posts as a feed...so I need to generate one....
GWGSo the idea is when they post for my challenge, they tell me so I can have the links to their submissions and someone can look in one place to find said list.
GWG Anyone have any thoughts on https://david.shanske.com/2022/05/15/thinking-about-planets-and-challenges/
gRegor I'm working on IndieAuth token introspection and wondering best way to add authorization, since it's a MUST in the spec. https://www.rfc-editor.org/rfc/rfc7662#section-2.1 gives an example "using a separate OAuth 2 access token" but I'm not sure how clients would get that separate token?
[snarfed] aha, yeah https://mailarchive.ietf.org/arch/msg/oauth/6En02o_TSsYOHiii2PyZVKF8MiQ/ implies it's a brute force attack too
jamietanna GWG gRegor, currently token introspection isn't auth'd, but I'll be moving to something like private_key_jwt instead of longer-lived credentials like basic auth, but basic auth with a per-client credential works too :)
[KevinMarks] This sounds promising https://christine.website/blog/fly.io-heroku-replacement
jacky ActivityPub << [https://codeberg.org/fediverse/delightful-activitypub-development/ a repository of libraries and projects]
Loqi ok, I added "[https://codeberg.org/fediverse/delightful-activitypub-development/ a repository of libraries and projects]" to the "See Also" section of /ActivityPub https://indieweb.org/wiki/index.php?diff=81462&oldid=81189 
@wikipediachain ↩️ Parma > Chiesi Farmaceutici > Preterm birth > Cerebral palsy > General movements assessment > White matter > Hypothalamus > Periventricular nucleus > ISSN (identifier) > ISO 20121 > Whirlpool (hash function) > PDF/UA > Web Content Accessibility Guidelines > IndieAuth > XPath 3 (twitter.com/_/status/1526248702184148992)
[tantek] Hmm, I read that and I don't see a clear problem statement of what problem you’re trying to solve, so I'd suggest doing that first (writing up specifically what problem you're trying to solve, and if you're not sure, describing maybe an "ideal" in terms of user-actions and expected results — purely in terms of user actions, with zero mention of protocols)