OAuth client: refresh before re-authorizing, and discover before refreshing - #3328

Closed

maxisbey wants to merge 5 commits into

mainfrom

oauth-refresh-on-401

Commits on Aug 18, 2026

OAuth client: refresh before re-authorizing, and discover before refreshing
maxisbey
committed
2bc618a
Address review: refresh-failure parity, CIMD token binding, pinning tests
maxisbey
committed
ab40324
Handle the CIMD issuer change beside the SEP-2352 guard so stale metadata is dropped too
maxisbey
committed
76542f8
Treat an unstamped CIMD record like one stamped elsewhere: drop its tokens, then stamp it
maxisbey
committed
7f01cd0
Fold the SEP-2352 issuer-binding rules into one method used at both discovery points
maxisbey
committed
caa022f