Financial-grade API Security Profile 1.0 - Part 2: Advanced - Githubissues

erlef / oidcc

OpenId Connect client library in Erlang & Elixir

https://hexdocs.pm/oidcc

Apache License 2.0

184 stars 49 forks source link

Financial-grade API Security Profile 1.0 - Part 2: Advanced #247

Closed maennchen closed 1 year ago

maennchen commented 1 year ago

Spec: https://openid.net/specs/openid-financial-api-part-2-1_0.html

Work Required

[ ] Based on #246
[ ] Support JARM (with setting to require it)
[ ] Support PAR
[ ] Add configuration that restricts the client to more safe settings
- [ ] Check s_hash in ID token (based on state)
- [ ] Require signed request object
- [ ] More restictive mTLS settings: TLS considerations
- [ ] No none algorithm
- [ ] No RSASSA-PKCS1-v1_5 algorithms like RS256
- [ ] jwks_uri require HTTPS
- [ ] No JWE x5u / jku
- [ ] Unique kid for JWK Sets (consider alg / use / kty and crv)

:pushpin: This issue is here to track interest for the implementation. Leave a :+1: if you would like this implemented.