[Openid-specs-ab] well-known location for sector_identifier_uri
James.H.Manger at team.telstra.com
Sun Mar 13 03:42:31 UTC 2016
The sector_identifier_uri [core §8.1<http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg>, dynamic reg §5<http://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation>] lists the redirect_uris of apps that can receive the same subscriber ids (subs) from OIDC providers that issuer pairwise subs. The list is effectively a domain authorizing the apps that are allowed to be associated with it.
Because it conveys a domain's authority, the sector_identifier_uri should have a fixed /.well-known/ path on the domain.
Otherwise, a domain may unwittingly authorize an app. Any content on a domain that happens to be a URI in square brackets can be misused by using it as a sector_identifier_uri to receive the domain's subs. Any redirect from a domain (not just an open redirector) can be misused by the destination of the redirect to receive the domain's subs.
To address this risk, how about we require sector_identifier_uri to be:
I'm not sure if this extra restriction can be done as a errata (to core & dynamic reg), or something more substantial is necessary.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Openid-specs-ab