core/appview/oauth/handler/ at b3ce5aec1fc1be6fd64e4346dc7a2d85f65c769c · alice.pds.demo.boltless.dev/core · Tangled

alice.pds.demo.boltless.dev / core

0

This repository has no description

0

core / appview / oauth / handler

1 file

at b3ce5aec1fc1be6fd64e4346dc7a2d85f65c769c

Mike P appview/oauth: verify "iss" parameter in auth response 1y ago

appview/oauth: verify "iss" parameter in auth response From https://datatracker.ietf.org/doc/html/rfc9207#section-2.4 : "Clients MUST [...] compare the result to the issuer identifier of the authorization server where the authorization request was sent to. [...] If the value does not match the expected issuer identifier, clients MUST reject the authorization response and MUST NOT proceed with the authorization grant." Signed-off-by: Mike P <fentiger@mythik.co.uk>

1 year ago