Add to security concerns section - Githubissues

aaronpk / draft-parecki-oauth-identity-assertion-authz-grant

Other

1 stars 5 forks source link

Add to security concerns section #12

Open sdesen opened 3 months ago

sdesen commented 3 months ago

6
and other threat models considerations
extra considerations for scopes and scope validation

kamronbatman commented 2 months ago

We should add some kind of verbiage similar to RFC 9470 Section 9 regarding authentication/sessions.
We should probably add some recommendation about the lifetime of the jag token to the effect of that the token should only live as long as necessary to exchange. This is reinforced by the idea that an oauth id-token refresh token can be used to get an unexpired id token to exchange for another id jag.