Add Guidance for the use of FAPI for payments

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2018-09-10

Payments are interesting from an OAuth perspective and there are many mistakes that implementers may make, for example:

• Executing the payment immediately after user authorisation rather than waiting for the RP to exchange the auth code for a token and hit a "confirm" or "complete" endpoint
• Using a scope value to represent a staged payment resource, but not adequately protecting that scope value

I suggest that we add some guidance around these issues.

---

Bitbucket status: resolved

Bitbucket origin: issue 172

[bitbucket-import-issues]

Originally submitted by tlodderstedt (Torsten Lodderstedt) on 2018-09-26

added text on first topic with more generic wording (session fixation) https://bitbucket.org/openid/fapi/commits/4c9652efbd6d5be7b703aba31cb555fcaebd55b4

Not sure about the scope swap/modification attack - dgtonge can you describe the attack first?

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2019-05-10

PR here: https://bitbucket.org/openid/fapi/pull-requests/103/added-section-on-session-fixation/diff

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2019-05-15

Merged in Add-Guidance-for-the-use-of-FAPI-for-payments ((Bitbucket #103)) Fixed #172.

added section on session fixation

Approved-by: Nat Sakimura <sakimuragmail.com>
Approved-by: Joseph Heenan <josephauthlete.com>

→ <<cset 5f86ad8>>