AS shall require that redirect URIs use the https scheme

[Torsten Lodderstedt]

FAPI 2 Baseline requires https redirect urls, this precludes custom schemes and redirects to the loopback device via http.

It seems like this was copied from FAPI 1.

[Daniel Fett]

Wording from the security bcp:

   Authorization responses MUST NOT be transmitted over unencrypted
   network connections.  To this end, AS MUST NOT allow redirect URIs
   that use the "http" scheme except for native clients that use
   Loopback Interface Redirection as described in [RFC8252],
   Section 7.3.

‌

[Daniel Fett]

Proposal to fix Issue #402

→ <<cset 01f077219385>>

[Dave Tonge]

Merged in danielfett/fapi2/http-redirect-uris (pull request #265)

Proposal to fix Issue #402

Approved-by: Dave Tonge Approved-by: Brian Campbell Approved-by: Joseph Heenan Approved-by: Torsten Lodderstedt

→ <<cset 45e5a135fd93>>