[osanderson]

Batch I of the 2026-10-18 review: the missing documentation and the wrong spec citations. Comments, docs, and a few error-message citations only; no behaviour changes.

Missing documentation

Where	What it now says
client.BeginAuthorization	Call it only from a deliberate, CSRF-protected request (a POST with a SameSite cookie or a CSRF token), not a plain GET any page can trigger.
resource.NoRevocation	A token the authorization server revoked stays usable until it expires, which falls short of what a FAPI deployment expects of a resource server.
resource.Dependencies.Nonces	Never the authorization server's own nonce store: RFC 9449 §8 and §9 keep them apart. serverresource refuses that; a Verifier built directly can't tell.
federation.CheckTrustMarkStatus	Call it after VerifyTrustMark, never instead of it.
README	Message Signing covers JAR and JARM; signed introspection responses aren't implemented.

The review's other documentation items were already done: per-issuer stores (#680), the WithQuery doc (#685), and an empty AllowedResources (already documented).

Spec citations

A re-audit of about 140 citations against the published texts confirmed these wrong ones:

• RFC 9101:
  • §5.3 doesn't exist; the request object's client_id rule is §6.3.
  • request_uri is refused at PAR by RFC 9126 §2.1, and inside a request object by RFC 9101 §4.
  • invalid_request_uri is defined in RFC 9101 §7, not RFC 9126 §2.3.
• RFC 9449:
  • resource-server nonces are §9, not §8;
  • "at most one DPoP header" is §4.3 check 1, not §7.1, and a sentence quoted as the RFC's isn't in it.
• OIDC Core:
  • at_hash is §3.1.3.8 / §3.2.2.9 (OPTIONAL for the code flow), not a MUST in §3.1.3.6;
  • azp is §3.1.3.7 steps 4–5 in the current text;
  • the "different user" rule is §3.1.2.2.
• CIBA: one-time auth_req_id redemption is §10.1.1 and poll mode §10.1, not §10.3 (Push Callback).
• RFC 7518: A256CBC-HS512 is §5.2.5, and ECDH-ES+A256KW is §4.6.
• OpenID Federation: the Trust Mark kid rule is §7; delegation validation is §7.2.2 (the type match is step 8); the delegation JWT's own rules are §7.2.1.
• Others: RFC 8705 chain validation and revocation are §2.1, and RFC 7592's registration access token is §1.2.
• Wording: RFC 9449 §10.1 doesn't recommend the PAR DPoP proof; it says the proof "provides a stronger binding". The wording now says that.
• Already fixed: the leftover draft-07 attestation citation in a test now cites draft-12 §10.3.

Testing

• go vet ./... and go test ./... pass.
• gofmt is clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud