Create a security consideration/note on A. Cuckoo’s Token Attack (FAPI 1.0)

[Nat Sakimura]

Need to document how we decided not to adopt the recommended mitigation in the security analysis.

[Joseph Heenan]

It is mentioned in the security considerations, https://openid.net/specs/openid-financial-api-part-2-1_0.html#access-token-phishing which says:

An attacker could try to trick a client under his control to make use of the access token as described in [FAPISEC] ("Cuckoo's Token Attack" and "Access Token Injection with ID Token Replay"), but these attacks additionally require a rogue AS or misconfigured token endpoint.

‌

[Nat Sakimura]

The same kind of thing needs to be documented in FAPI 2.0.

[Nat Sakimura]

Ok. It was in the security considerations already so I will mark this as invalid.