Skip to content

FAPI_Meeting_Notes_2025 04 02_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI Working Group Meeting Notes (2025-04-02)

  • Date: 2025-04-02 14:00 UTC
  • Location: Zoom

Attendees

Nat Sakimura (Chair), Dave Tonge (Chair), George Fletcher, Joseph Heenan, Dima Postnikov, Filip Skokan, Joe DeCock, Kosuke Koiwai, Bjorn Hjelm, Peter Wallach, Peter Stanley, Gail Hodges

Agenda

  1. Roll Call
  2. Adoption of Agenda
  3. Events (Mike L.)
  4. External Orgs & Liaisons (Mike L.)
  5. PRs (Dave)
  6. Issues (Dave)
    • 6.1 Issues from last week action items
    • 6.2 Other issues
  7. AOB (Nat)

Events

  • April 7th: OIDF Workshop prior to IIW. Registration is closed.
  • April 8-10: IIW Spring 2025 – Mountain View
  • April 28 - May 1: RSA 2025 – San Francisco
  • May 5th: DCP WG in-person meeting in Berlin (12-4pm CET), hybrid webinar with demo (4:30-6pm), reception (6:30pm)
  • May 6-9: EIC – Berlin
  • May 20-23: ID4Africa – Addis Ababa, Ethiopia
  • May: Rwanda Open Banking Event/Workshop (private)
  • June 3-6: Identiverse – Las Vegas
  • FDX Global Summit (end of April in Washington, D.C.) - Joseph and Gail will present on the benefits of the "blue" profile
  • Federation Interop event in Sweden (end of April)

External Orgs & Liaisons

  • Brazil: Open Finance and Open Insurance annual FAPI recertifications continue
  • DCP WG is hosting small group interop events on April 4th and April 25th to build up to the May 5th hybrid webinar

PRs

Dave pushed a PR (#537) just before the call for the JAM errata, which includes editorial changes:

  • Updated author organizations
  • Updated security topics reference to RFC 9700
  • Updated version and copyright notice

The only substantive change in the errata is addressing the IANA registrations that weren't set up properly. Nat approved the PR.

Issues

Issue #719 (DOI link)

  • Can be resolved as the PR was merged with the reference to the security analysis using the DOI link

Issue #621 (FAPI2 Message Signing implementations)

  • No new implementations reported
  • Reminder for anyone with FAPI2 Message Signing implementations to report them

Issue #273 (Security considerations for large access tokens)

George proposed text for the implementation and deployment advice document:

"As key size grows, and more claims added to access tokens, it's possible for the HTTP authorization header containing the access token plus other headers to cumulatively be larger than the allowed buffer size for HTTP requests in many web infrastructure components. It's important to watch this closely via logging and alerting to ensure that production traffic is not adversely affected, and that adjustments to the allowed buffer size can be made in a timely manner."

Discussion:

  • Kosuke supported adding the text, noting he has experienced buffer size issues in production
  • Dima noted it might not be concrete enough for implementers, but agreed it's a good addition
  • George explained it's difficult to be too prescriptive since different web components handle this differently
  • Consensus was to add the text to the implementation advice document
  • The default buffer size is typically around 8K, but this wasn't added to the text to avoid being too specific

Issue #260 (Android app links)

Joseph reported that Android app links remain weaker than Universal Links:

  • The auto-verify feature helps, but there are still issues if the official app isn't installed
  • A rogue app can claim the URL using lower security mechanisms
  • Android has not fixed the issue where only one app can claim the URL (like Universal Links)

Recommendations:

  • Include guidance in security considerations that Android app links are not a full protection against impersonation
  • Mention that app links are still better than custom schemes
  • Note other methods to protect against impersonation on Android (app attestation, device attestation)

Issue #290 (X-FAPI-Interaction-ID)

Discussion about interaction IDs for debugging and flow tracking:

  • The X-FAPI-Interaction-ID header is useful for troubleshooting
  • Question about using the same interaction ID across multiple parts of the flow
  • Filip noted it's not possible for clients to add the interaction ID to authorization requests in redirects
  • The interaction ID is not trusted for security, just useful for debugging
  • Consensus to keep using the X- prefix despite it being technically deprecated (RFC 6648)
  • Dima will update the issue and suggest a PR with guidance that:
    1. Keep the existing X-FAPI-Interaction-ID usage similar to FAPI 1
    2. Acknowledge that linking to multiple requests is possible but not for redirect parts of the flow

AOB

Discussion about US/Canada Open Banking Subgroup:

  • Mike had circulated a proposal to create a formal Special Topic Group under FAPI WG
  • Dima suggested first inviting the subgroup to join the regular FAPI calls
  • George noted important topics would be FDX's use of FAPI, Canada's approach, and ecosystem support
  • Consensus that a separate group isn't needed yet - invite the subgroup to regular FAPI calls
  • Will maintain the Slack thread but dissolve the current subgroup structure
  • Will update the board on Monday about this decision

Action Items

  1. Add George's proposed text about buffer size limitations to the implementation guide (Issue #273)
  2. Continue discussion on security considerations for Android app links (Issue #260)
  3. Dima to update Issue #290 and suggest a PR for X-FAPI-Interaction-ID guidance
  4. Invite US/Canada Open Banking Subgroup to regular FAPI calls
  5. Find a driver for documenting DPoP vs MTLS trade-offs (carried forward)

The meeting was adjourned at 14:59 UTC.

Clone this wiki locally