Resolve question of entropy in client-generated state param at authorization

blue-button / blue-button-plus-pull

Spec for BlueButton+ Pull

http://blue-button.github.io/blue-button-plus-pull/

20 stars 11 forks source link

Resolve question of entropy in client-generated state param at authorization #23

Open jmandel opened 11 years ago

jmandel commented 11 years ago

Reported by Joseph Lorenzo Hall via http://wiki.siframework.org/BlueButtonPlus+Pull+API+Documentation+Consensus

https://github.com/blue-button/blue-button-plus-pull/blob/eb86bcfb02fad0c877b9c36976ee6bcd99b77749/index.html#L1492 leaves an open question

jmandel commented 11 years ago

@jricher I'd suggest we say "The state parameter SHOULD be used, with sufficient entropy for preventing cross-site request forgery." If you want to make a specific entropy recommendation (or requirements) in bits, let me know what you have in mind.

jricher commented 11 years ago

I'm fine with that -- what we ended up doing in OpenID Connect's latest draft is to say "sufficient entropy" and then list examples of "bad entropy", like a static value, increasing sequence of integers, and things like that.