allow error responses to contain a nonce

c2bo · c2bo · commit d5b7b4d2509b · 2025-06-02T22:45:42.000+02:00
diff --git a/draft-ietf-oauth-attestation-based-client-auth.md b/draft-ietf-oauth-attestation-based-client-auth.md
@@ -460,9 +460,9 @@ Content-Type: application/json
 }
 ~~~
 
-## Providing Challenges on Previous Successful Responses
+## Providing Challenges on Previous Responses
 
-The Authorization Server MAY provide a fresh Challenge on any previous successful response using a HTTP header-based syntax. The HTTP header field parameter MUST be named "attestation-challenge" and contain the value of the Challenge. The Client MUST use this new Challenge for the next OAuth-Client-Attestation-PoP.
+The Authorization Server MAY provide a fresh Challenge on any previous successful response using a HTTP header-based syntax. The HTTP header field parameter MUST be named "attestation-challenge" and contain the value of the Challenge. The Client MUST use this new Challenge for the next OAuth-Client-Attestation-PoP. Note that this also includes error responses.
 
 The following is a non-normative example of an Authorization Response containing a fresh Challenge:
 

Original file line number	Diff line number	Diff line change
`@@ -460,9 +460,9 @@ Content-Type: application/json`
`460`	`460`	`}`
`461`	`461`	`~~~`
`462`	`462`
`463`		`-## Providing Challenges on Previous Successful Responses`
	`463`	`+## Providing Challenges on Previous Responses`
`464`	`464`
`465`		`-The Authorization Server MAY provide a fresh Challenge on any previous successful response using a HTTP header-based syntax. The HTTP header field parameter MUST be named "attestation-challenge" and contain the value of the Challenge. The Client MUST use this new Challenge for the next OAuth-Client-Attestation-PoP.`
	`465`	`+The Authorization Server MAY provide a fresh Challenge on any previous successful response using a HTTP header-based syntax. The HTTP header field parameter MUST be named "attestation-challenge" and contain the value of the Challenge. The Client MUST use this new Challenge for the next OAuth-Client-Attestation-PoP. Note that this also includes error responses.`
`466`	`466`
`467`	`467`	`The following is a non-normative example of an Authorization Response containing a fresh Challenge:`
`468`	`468`