Title	T	P	Status	Votes	Assignee	Milestone	Created	Updated
#185: PKCE or Part2 mechanisms? FAPI 1: Baseline	bug	major	closed		Joseph Heenan	3rd Implementers Draft	2018-11-04	2023-04-17
#196: OAuth Security BCP and FAPI FAPI 1: Baseline	bug	major	closed				2018-12-19	2020-04-15
#86: The read only spec should not contain 'if possible' in section 5.2.2 FAPI 1: Baseline	enhancement	major	closed		Joseph Heenan		2017-04-25	2019-08-21
#187: Part 1 client requirements for state/nonce aren't reflected as authorization server requirements FAPI 1: Baseline	bug	major	closed		Joseph Heenan		2018-11-06	2019-07-24
#213: requirements on RSA/EC key sizes should apply to more situations FAPI 1: Baseline	bug	major	closed		Joseph Heenan		2019-01-28	2019-03-13
#11: OAuth Profile should mandate RFC7636 (PKCE) for code flow FAPI 1: Baseline	proposal	major	closed	1			2016-08-02	2018-07-23
#5: Create Read Only Security Profile FAPI 1: Baseline	task	major	closed			R2 - Nov 2016	2016-07-04	2018-01-29
#21: Residual Data clause should be generalized and moved to privacy considerations FAPI 1: Baseline	bug	major	closed		Nat Sakimura	R1 - Aug 2016	2016-08-02	2018-01-29
#22: Undefined OAuth response parameter "user_id" appears in the text FAPI 1: Baseline	bug	major	closed		Anoop Saxena		2016-08-02	2018-01-29
#51: Message source authentication failure - FAPI 1: Baseline	proposal	minor	closed				2016-12-08	2018-01-29
#84: RFC2616 is obsolete and references to it should be replaced with updated RFCs FAPI 1: Baseline	bug	major	closed				2017-04-12	2017-05-10
#79: Part 1: issues with x-fapi-customer-last-logged-time header FAPI 1: Baseline	bug	major	closed				2017-03-22	2017-04-06
#63: There is no qualification on x-fapi-customer-id FAPI 1: Baseline	bug	major	closed		Nat Sakimura		2017-01-30	2017-02-03
#69: Notes like this are strange “NOTE: Providing access to Javascript clients or not has different security properites.;” FAPI 1: Baseline	bug	major	closed		Sascha Preibisch		2017-01-31	2017-02-02