%% You should probably cite rfc8473 instead of this I-D. @techreport{ietf-tokbind-https-13, number = {draft-ietf-tokbind-https-13}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-tokbind-https/13/}, author = {Andrei Popov and Magnus Nyström and Dirk Balfanz and Adam Langley and Nick Harper and Jeff Hodges}, title = {{Token Binding over HTTP}}, pagetotal = 25, year = 2018, month = apr, day = 13, abstract = {This document describes a collection of mechanisms that allow HTTP servers to cryptographically bind security tokens (such as cookies and OAuth tokens) to TLS connections. We describe both first-party and federated scenarios. In a first- party scenario, an HTTP server is able to cryptographically bind the security tokens it issues to a client, and which the client subsequently returns to the server, to the TLS connection between the client and server. Such bound security tokens are protected from misuse since the server can generally detect if they are replayed inappropriately, e.g., over other TLS connections. Federated token bindings, on the other hand, allow servers to cryptographically bind security tokens to a TLS connection that the client has with a different server than the one issuing the token. This Internet-Draft is a companion document to The Token Binding Protocol.}, }