Behaviour of AS when presented with a non-uuid x-fapi-interaction-id is not clearly defined

[Joseph Heenan]

We ran into an interoperability issue in the OB UK ecosystem whereby a client that sent a non-uuid x-fapi-interaction-id header was accepted by some banks and rejected by others. The spec should perhaps be clearer on this.

[Nat Sakimura]

Maybe relax the client requirement.

[Joseph Heenan]

We confirmed on the call that the intention is that the client must only send a uuid, as otherwise we’d want more text to set a length limit / allowing char set / etc
I suggest changing:

may send the x-fapi-interaction-id request header whose value is a RFC4122 UUID to the server to help correlate log entries between client and server, e.g., x-fapi-interaction-id: c770aef3-6784-41f7-8e0e-ff5f97bddb3a.

to:

may send the x-fapi-interaction-id request header, in which case the value shall be a RFC4122 UUID to the server to help correlate log entries between client and server, e.g., x-fapi-interaction-id: c770aef3-6784-41f7-8e0e-ff5f97bddb3a.

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/174/clarify-uuid-requirement

[Dave Tonge]

PR merged in