[Openid-specs-fapi] JWT Secured Authorization Response Mode (#155)
torsten at lodderstedt.net
Fri Aug 17 14:49:57 UTC 2018
> Am 17.08.2018 um 15:39 schrieb Brian Campbell <bcampbell at pingidentity.com>:
> Good point. OIDC Core (http://openid.net/specs/openid-connect-core-1_0.html#Security) does not discuss this attack angle. From your perspective, what is the typical way to detect crafted/modified ID Tokens in the id_token flow?
> Checking the signature. But if the issuer isn't known or expected, don't go trying to find keys for it, just reject the token.
I would like to summarize the discussion regarding handling of state value and response processing.
From what I understand, the processing would work as follows (assuming the „state" is carried in the JWT):
1) decrypt JWT using the client's private key - the key is determine by the „kid“ header parameter
2) obtain „state“ from JWT
3) check binding of state value to user agent, if check fails - abort processing
4) obtain „iss" from JWT
5) check whether „iss" is known and expected („aud“ could be checked in this step as well), if not abort processing
6) obtain signing key based on „iss“ and „kid"
7) check signature, if signature validation fails - abort processing
8) use response parameters
Does this capture your thoughts correctly?
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 3872 bytes
Desc: not available
More information about the Openid-specs-fapi