specify native app restriction for clarity on client authentication section

[sdesen]

This establishes this client as a confidential client,

Might be worth nothing this is only possible for clients that support credentials in the first place?

[ThisIsMissEm]

So in the case of native apps, you could use the OAuth 2.0 Attestation-Based Client Authentication draft, which would allow a native app to have a client-specific JWT key published into the jwks_uri keyset.

This sentence is also directly following an example:

[JetA2]

Native apps can pass a generated public key as part of the Client ID such as https://example.com/[encoded key]/client_id.json which then enables authentication as a confidential client.

This is a very straightforward solution from a developer point of view but does it create security issues?

[ThisIsMissEm]

Native apps can pass a generated public key as part of the Client ID such as https://example.com/[encoded key]/client_id.json which then enables authentication as a confidential client.

This is a very straightforward solution from a developer point of view but does it create security issues?

@JetA2 that would be a security issue as it's broadcasting a symmetrical secret over the network.

(It also wouldn't work since we prohibit all symmetrical or shared secret methods for client authentication)

[matthieusieben]

@JetA2 There is no real issue in terms of security to use an encoded public key in the client id, but you'd basically be creating a new oauth profile that provides similar properties to DPoP (but is not standard). It could be "dangerous" as you might be tempted to give a higher level of thrust to that client, when really it's a public client in disguise

In atproto, we prefer to define "confidential" clients as "services that can revoke credentials at scale, Typically by rotating jwks".

[JetA2]

Would a reason for revoking credentials at scale be that multiple client sessions use the same credentials and those credentials got compromised?
In that case would this client feature still be needed if every client (as in native app install) had their own unique credentials?

[aaronpk]

Native apps can pass a generated public key as part of the Client ID such as https://example.com/[encoded key]/client_id.json which then enables authentication as a confidential client.

This is basically getting you the same security properties as DPoP, so just use DPoP.