Part 1 client requirements for state/nonce aren't reflected as authorization server requirements

[Joseph Heenan]

Part 1 requires clients send nonce (if requested openid in scope) and state otherwise.

I am thinking that there should be a clause in the authorization server section that means the server requires state/nonce as appropriate and rejects requests without them.

[Torsten Lodderstedt]

I'm surprised. state should always be required in order to implement CSRF detection. nonce could be used for that if the nonce is delivered in the frontchannel. If it is delivered via backchannel, I would prefer state since the client can earlier refuse redirect processing.

[Joseph Heenan]

pull request opened at https://bitbucket.org/openid/fapi/pull-requests/114/fapi-r-as-must-require-state-nonce-as/diff

[Nat Sakimura]

FAPI-R: AS must require state/nonce as applicable

Currently although clients are required to send state (if not using openid) or nonce (if using openid) however the authorization server was not required to reject requests without them.

Now it is. New sections are deliberately added for the openid vs non-openid causes to avoid needing to renumber clauses if any further requirements are added to either case.

closes #187

→ <<cset 4af35fbbf9e1>>