Claim redirect_uri on token request #209
Conversation
add claim redirect_uri
add required claim redirect_uri
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
The update of the token request non normative example is required |
upd examples
upd examples
Co-authored-by: Giuseppe De Marco <[email protected]>
Co-authored-by: Giuseppe De Marco <[email protected]>
Co-authored-by: Giuseppe De Marco <[email protected]>
Co-authored-by: Giuseppe De Marco <[email protected]>
Co-authored-by: Giuseppe De Marco <[email protected]>
|
According to https://openid.net/specs/openid-connect-core-1_0.html#TokenRequestValidation we don't have the requirement of redirect_uri in the token request. I suggest to change this PR by saying that if present, the request_uri must ... |
| * - **redirect_uri** | ||
| - Required. It MUST be one of the values declared into the claim **redirect_uris** in the RP metadata and it MUST match the value of the claim **redirect_uri** included in the previous authorization request. | ||
| - |spid-icon| |cieid-icon| |
There was a problem hiding this comment.
I don't see any normative section within OIDC Core and iGov Profile requiring redirect_uri as a mandatory claim in the token request. Moreover, I see no security issues if this claim is omitted. I suggest considering it as OPTIONAL saying that if it is present the OP MUST check that it is the same value provided in the authorization request and the same value included in the RP Metadata.
Claim redirect_uri on token request
Add required claim redirect_uri on token request
Review