JARM: JWT claims iss, aud and exp missing in authz error example

[Vladimir Dzhuvinov]

https://openid.net//specs/openid-financial-api-jarm.html#response-type-code

The JWT payload example should include the iss, aud and exp claims:

{
   "error":"access_denied",
   "state":"S8NJ7uqk5fY4EjNvP_G_FtyJu6pUsvH9jsYni9dMAJw"
}

[Brian Campbell]

Good catch. Pull request #82 would add the iss, aud and exp claims to that example.

[Tom Jones]

whatever for? The error messages should give as little information as possible. Stop trying to help the attacker!

[Vladimir Dzhuvinov]

@tomcjones How do you see those three JWT claims potentially causing a security problem in a error response?

The iss and aud are essentially public information, and even if they are omitted, they can still be inferred if an attacker intercepted the JWT. The JWT header will likely include a "kid" or by validating the JWT signature, it can be verified who issued it. The client_id is also not something secret.

I find it's the opposite -- if aud and exp are missing, the client cannot be sure if the response isn't being replayed, and this ends up defeating the purpose of JARM.

[Tom Jones]

everywhere i go in oauth and openid i get the distinct sense that well known security facts are not understood at all. sigh.

[Nat Sakimura]

Merged

[Brian Campbell]

pull request #82 was merged at 6178b6a to address this