{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157","labels_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157/labels{/name}","comments_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157/comments","events_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157/events","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157","id":113679102,"number":157,"title":"Consider updating the validation endpoint to return a reason/status item","user":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-27T20:20:04Z","updated_at":"2015-10-28T17:36:45Z","closed_at":null,"body":""},"comment":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/comments/151922021","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157#issuecomment-151922021","issue_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/157","id":151922021,"user":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"created_at":"2015-10-28T17:36:45Z","updated_at":"2015-10-28T17:36:45Z","body":"Hey, that's not fair if you always quote the same guy (who's the author of the spec :smile:)\r\n\r\n> Either way, you don’t actually want to divulge too much information about why the token is bad in a production environment or else you let attackers poke around and learn more about the system than they really need to know to function.\r\n\r\nSadly, it's the 3rd message I read where there's no practical case demonstrating why (concretely) divulging why an access token was rejected is so bad.\r\n\r\n> As far as a protected resource is concerned, it likely doesn’t matter anyway. And an OAuth client isn’t going to be propagated that information, it’s just going to have to go get a new token.\r\n\r\nI couldn't agree less. I've been asked at least 5 times how the JWT bearer middleware could be modified to return this precise information. Not everyone is an OAuth2 expert and many developers WANT to inform their API users why an access token was rejected (invalid, expired, revoked...)."}}