clarify that Status List validation SHOULD not be performed if Refere… (#348)

* clarify that Status List validation SHOULD not be performed if Referenced Token validation is deemed invalid already

* Update draft-ietf-oauth-status-list.md

* update history entry

Author: paulbastian

draft-ietf-oauth-status-list.md

@@ -667,7 +667,7 @@ Content-Type: application/statuslist+jwt
 
 ## Validation Rules
 
-Upon receiving a Referenced Token, a Relying Party MUST first perform the validation of the Referenced Token - e.g., checking for expected attributes, valid signature and expiration time. The processing rules for Referenced Tokens (such as JWT or CWT) MUST precede any evaluation of a Referenced Token's status. For example, if a token is evaluated as being expired through the "exp" (Expiration Time) but also has a status of 0x00 ("VALID"), the token is considered expired. As this is out of scope for this document, this validation is not described here, but is expected to be done according to the format of the Referenced Token.
+Upon receiving a Referenced Token, a Relying Party MUST first perform the validation of the Referenced Token - e.g., checking for expected attributes, valid signature and expiration time. The processing rules for Referenced Tokens (such as JWT or CWT) MUST precede any evaluation of a Referenced Token's status. For example, if a token is evaluated as being expired through the "exp" (Expiration Time) but also has a status of 0x00 ("VALID"), the token is considered expired. If the validation procedures for the Referenced Token determine it is invalid, no further procedures regarding Status List MUST be performed, e.g. fetching a Status List Token, unless the Referenced Token procedures or the use case require further evaluation.
 
 If this validation is not successful, the Referenced Token MUST be rejected. If the validation was successful, the Relying Party MUST perform the following validation steps to evaluate the status of the Referenced Token:
 
@@ -1821,6 +1821,10 @@ CBOR encoding:
 
 \[\[ To be removed from the final specification \]\]
 
+-17
+
+* clarify that Status List validation MUST not be performed if Referenced Token validation is deemed invalid already
+
 -16
 
 * change http status codes & query parameter wording for the historical resolution