Messages 5.3 Check ID Request Verification

[John Bradley]

The Authorization Server MUST check that the d_token parameter is present and that if it is signed, it MUST be verify the signature according to Section 5 of

Our default signature alg is HS256 so the endpoint can't be stateless. It needs to lookup the client secret to validate the token before responding. The Check ID endpoint not properly checking would be a major Fail. I will add some warning text.

The alternatives are: 1 making asymmetric the default.
2 eliminating Check ID 3 Live with state full.

[John Bradley]

re #380 Messages - 5.3 Add text about how to validate symmetric sig.

→ 44138519a1f5

[John Bradley]

Clarifying text on verification of symmetric signatures closes ticket.