# Defaults of ClientSettings.builder().build() and TokenSettings.builder().build(),
# read out of the jars themselves rather than from documentation.
# Source: tools/SettingsDefaults.java

=== Spring Authorization Server 1.5.8 (last release of the standalone project) ===
requireProofKey            = false
requireAuthorizationConsent= false
accessTokenTimeToLive      = PT5M
accessTokenFormat          = self-contained
refreshTokenTimeToLive     = PT1H
reuseRefreshTokens         = true
authorizationCodeTTL       = PT5M

=== Spring Authorization Server 7.1.1 (inside Spring Security, Boot 4.1.1 BOM) ===
requireProofKey            = true
requireAuthorizationConsent= false
accessTokenTimeToLive      = PT5M
accessTokenFormat          = self-contained
refreshTokenTimeToLive     = PT1H
reuseRefreshTokens         = true
authorizationCodeTTL       = PT5M

# The same question on the CLIENT side. Source: tools/ClientPkceDefault.java

=== spring-security-oauth2-client 6.5.1 ===
ClientRegistration.ClientSettings.requireProofKey = false

=== spring-security-oauth2-client 7.1.1 (Boot 4.1.1 BOM) ===
ClientRegistration.ClientSettings.requireProofKey = true

# Both sides flipped in the 7.x line. Spring-to-Spring therefore still works;
# a 7.1 authorization server in front of a 6.x or hand-rolled client does not.