Gabriel Corona

@unprovable, any feedback?

> sent over HTTPS "using the HTTPS scheme"?

> [MODIFIED] Verify that the application only loads or executes code, modules, content or plugins from sources not under the application's direct control/protection if it employs integrity protections, such as...

> preferably to a single resource server. FWIW, this condition is less important (sometimes) when using sender-constrained tokens.

Proposition of minor rewording: > Verify that the resource server validates that the access token is intended to be usable on that resource server (audience), for example by checking the...

Or: > Verify that the resource server rejects the request if the access token was not intended to be usable on that resource server (audience), for example by checking the...

OK for the positive one. Is it clear enough?

I don't know :) it's probably OK like that.

Proposition including token introspection: > Verify that the resource server validates that the access token is intended to be used on that resource server (audience). When the access token is...

Nitpicky changes: | # | Description | L1 | L2 | L3 | | :---: | :--- | :---: | :---: | :---: | | **51.4.2** | [ADDED] Verify that...