JARM: JWT claims iss, aud and exp missing in authz error example
https://openid.net//specs/openid-financial-api-jarm.html#response-type-code
The JWT payload example should include the iss, aud and exp claims:
{
"error":"access_denied",
"state":"S8NJ7uqk5fY4EjNvP_G_FtyJu6pUsvH9jsYni9dMAJw"
}
Comments (6)
-
-
whatever for? The error messages should give as little information as possible. Stop trying to help the attacker!
-
reporter @tomcjones How do you see those three JWT claims potentially causing a security problem in a error response?
The
iss
andaud
are essentially public information, and even if they are omitted, they can still be inferred if an attacker intercepted the JWT. The JWT header will likely include a "kid" or by validating the JWT signature, it can be verified who issued it. The client_id is also not something secret.I find it's the opposite -- if
aud
andexp
are missing, the client cannot be sure if the response isn't being replayed, and this ends up defeating the purpose of JARM. -
everywhere i go in oauth and openid i get the distinct sense that well known security facts are not understood at all. sigh.
-
- changed status to resolved
Merged
-
pull request #82 was merged at 6178b6a to address this
- Log in to comment
Good catch. Pull request #82 would add the
iss
,aud
andexp
claims to that example.