Normative text within security considerations

[Joseph Heenan]

The JWKS URIs section under security considerations has 3 normative requirements in it:

https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html#section-6.3

any server providing a jwks_uri endpoint

1. shall only serve the jwks_uri endpoint over TLS;
2. should not use the JOSE headers for x5u and jku; and
3. should not serve a JWK set with multiple keys with the same kid.

I think we had a policy against having normative requirements in the security considerations section?

[Joseph Heenan]

Section 6.4 also contains one normative looking requirement.

[Nat Sakimura]

• For 6.4, it was proposed to move to subclause 5.4.
• For 6.3, probably the same place.

‌

[Nat Sakimura]

Nat to ask the list for a volunteer to create a PR.

[Nat Sakimura]

Dave will do it this week.

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/511

[Dave Tonge]

PR Merged