Add mandatory IDP referrer check - #338
Conversation
samuelgoto
left a comment
samuelgoto
left a comment
There was a problem hiding this comment.
LGTM
Will merge when comments are addressed
| ``` | ||
| </div> | ||
|
|
||
| An [=IDP=] needs to check the referrer to ensure that a malicious [=RP=] does not receive an ID |
There was a problem hiding this comment.
Is this a normative conformace requirement to IDPs? If so, is there something like NOTE: that we could use to collect those?
There was a problem hiding this comment.
Anything within a note is non-normative text. So I chose to not put it inside a note.
There was a problem hiding this comment.
Added style per offline discussion.
Co-authored-by: sam goto <samuelgoto@gmail.com>
|
ptal |
SHA: 3f86d58 Reason: push, by @samuelgoto Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
| </div> | ||
|
|
||
| <div class=idp-normative-text> | ||
| An [=IDP=] needs to check the referrer to ensure that a malicious [=RP=] does not receive an ID |
There was a problem hiding this comment.
Nit: using RFC 2119 language here to identify this more clearly as a normative statement would be helpful.
E.g. An IDP MUST check the referrer header matches the expected client id for the RP. If the referrer does not match the client id the IDP MUST reject the request.
* Add mandatory IDP referrer check * Update spec/index.bs Co-authored-by: sam goto <samuelgoto@gmail.com> * style Co-authored-by: sam goto <samuelgoto@gmail.com>
3 participants
Fixes #325
Preview | Diff