require PKCE / FAPI

[jogu]

HAIP currently requires PKCE, but doesn't actually require that servers reject requests without PKCE.

As was done in a similar discussion in VCI ( openid/OpenID4VCI#534 ) we should consider just mandating FAPI2 instead.

[Sakurann]

so is the proposal here to change the text in VCI that says "SHOULD" to "MUST"? so something like:

Implementers MUST follow the [@!FAPI2_Security_Profile] where it is applicable.

[jogu]

Discussed on today's WG call - this would mean we're essentially importing FAPI's definition of high-value and sensitive data which might be a good thing, but it's a big decision and we should discuss further.

[lj-raidiam]

FAPI's ... high-value and sensitive (personal and other) data, for example, in e-health and e-government applications.
seems to fit HAIP's high level of security and privacy is required

[jogu]

Discussed on today's WG call.

May need carve out around the IAR endpoint vs PAR in FAPI2 as well.

Agreed to draft PR text so people can see an exact proposal for the changes.