Baseline: Clause 7.4.1 Talks about security issues with authorization requests and responses but incorrectly refers to encrypting authorization 'responses' not requests.

[Ralph Bragg]

7.4.1.  Authorization request and response

In this document, the authorization request is not encrypted. Thus, it is possible to leak the information contained if the web browser is compromised.

Authorization response can be encrypted as ID Token can be encrypted.

This should read

Authorization requests can be encrypted and an ID Token can be encrypted to mitigate;

[Daniel Fett]

I think that this is correct as is. The first sentence is for the authorization request. The second sentence says that the response (unlike the request) can be ‘encrypted’ by encrypting the ID token.

[Ralph Bragg]

But the implication of these two sentences is that the issue with leaking data in the request can be mitigated by encrypting the response which isn’t correct.

[Dave Tonge]

So I think the wording could be improved. @Nat Sakimura what is the process for errata?

[Nat Sakimura]

As it stands, it is not proposing anything to mitigate the threats in the request. Since Baseline does not create request object, it has no option of encrypting it either.

[Dave Tonge]

we discussed on the call changing the 2nd sentence to read:

The leakage of information from the ID token can be mitigated by encrypting the ID token. If the leakage of any other information in the authorization response is of concern then consider using JARM with encryption

‌

[Dave Tonge]

Merged in fapi1_errata_428 (pull request #428)

fixes #428 -

• fixes #428 - Baseline: Clause 7.4.1 Talks about security issues with authorization requests and responses but incorrectly refers to encrypting authorization 'responses' not requests.

• fixes #428 - update text for using encryption and JARM if desired.

Approved-by: Dima Postnikov Approved-by: Dave Tonge Approved-by: Nat Sakimura Approved-by: Joseph Heenan

→ <<cset 19a6d5ef55d1>>

[Dave Tonge]

Merged in fapi1_errata_428 (pull request #428)

fixes #428 -

• fixes #428 - Baseline: Clause 7.4.1 Talks about security issues with authorization requests and responses but incorrectly refers to encrypting authorization 'responses' not requests.

• fixes #428 - update text for using encryption and JARM if desired.

Approved-by: Dima Postnikov Approved-by: Dave Tonge Approved-by: Nat Sakimura Approved-by: Joseph Heenan

→ <<cset 19a6d5ef55d1>>

[Dave Tonge]

Merged in fapi1_errata_428 (pull request #428)

fixes #428 -

• fixes #428 - Baseline: Clause 7.4.1 Talks about security issues with authorization requests and responses but incorrectly refers to encrypting authorization 'responses' not requests.

• fixes #428 - update text for using encryption and JARM if desired.

Approved-by: Dima Postnikov Approved-by: Dave Tonge Approved-by: Nat Sakimura Approved-by: Joseph Heenan

→ <<cset 19a6d5ef55d1>>