Subject: [Txauth] Questions on key validations by RS

From: Ryo Kato <[email-masked]>
Date: Sat, 1 Feb 2020 05:13:07 +0900

Hi,

I'm reading the draft 04, and I have some questions now.

The draft says:
```
The Resource Server (RS) accepts tokens from the RC and validates them
```
and also
```
Any keys presented by the RC to the AS or RS MUST be validated as part of
the transaction in which they are presented.
```

Therefore, I understand that the *RS* MUST validate the proof of
possession of
RC's keys when accepting tokens from the RC.
(And I understand this procedure is for so called "sender-constrained
token")

However, I think it is a bit ambiguous about the way for *RS* to
validate that keys.

Assuming the `proof` parameter is `jwsd`, i.e. Detached JWS.

The current draft 04 says:

```
the RC takes the serialized body of the request and signs it
```

Yes, RC's transaction (continuation) requests to AS are always HTTP POST
requests,
and their body is always a non-empty JSON object.

Whereas, RC's requests to *RS* are not always POST, so they can be plain
GET requests.
Since GET request body is missing in general, the input for JWS will be
missing too.

In this case, what should we take for JWS instead of request body?

- Ryo