Unclear request method for /securesession/refresh

[hagould]

The basic DBSC spec describes both GET and POST requests to /securesession/refresh, the high level overview only uses GET with headers, but the refresh procedure is showing POST for the scenario where the server chooses to end the session. Is one of these outdated, or otherwise, how would an RP hint to the client which type of request to make?

[chen-chao]

It seems the chart in high level overview is outdated. By design the registration and refresh procedure are very similar, so they should both use POST.

[kmonsen]

Thank you both, I have updated both the text and diagram. Please let me know if I missed a place, or close this issue if it looks OK now.