Sender constraining the code

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2017-05-03

For AS that provides request object registration endpoint, the AS can actually bind the code to the client certificate that was used to authenticate at the request object registration endpoint. This mitigates the code phishing attack.

---

Bitbucket status: invalid

Bitbucket origin: issue 88

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2017-05-13

It is constrained as we require PKCE in the public client case. For confidential client case, RFC6749 is already sender constraining.