(ed) Privacy considerations is a top level clause while Security considerations is a second level subclause

[Nat Sakimura]

Currently, they are:

• 5.7.  Security considerations
• 6.  Privacy considerations

They probably should be

• 6.  Security considerations

  • 6.1.  Access token lifetimes
  • 6.2.  DPoP proof replay
  • 6.3.  JWKS URIs
  • 6.4.  Duplicate key identifiers
  • 6.5.  Injection of stolen access tokens
  • 6.6.  Authorization request leaks lead to CSRF
  • 6.7.  Browser-swapping attacks
  • 6.8.  Incomplete or incorrect implementations of the specifications

• 7.  Privacy considerations

If this change is to be implemented, it will impact the references to the clause numbers later than 5.7. Only the instance found by now is “See Clause 8 for normative references.” in clause 2.

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/478

[Dave Tonge]

PR merged