<div dir="ltr">Dear AB/C WG: <div><br></div><div>We should at least strive to correct apparent errors like "id-token" (it should be "id_token"). </div><div>I suggest adding this as an agenda item and creating an ad-hoc group to deal with the response. </div><div><br></div><div>Best regards, </div><div><br></div><div>Nat Sakimura</div><div><br></div><div><br><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Mike Leszcz</strong> <span dir="auto"><<a href="mailto:mike.leszcz@oidf.org">mike.leszcz@oidf.org</a>></span><br>Date: 2025年3月12日(水) 23:27<br>Subject: REMINDER: Requesting Feedback on OWASP ASVS 5.0<br>To: Nat Sakimura <<a href="mailto:nat@sakimura.org">nat@sakimura.org</a>>, Mark Haine <<a href="mailto:Mark.Haine@oidf.org">Mark.Haine@oidf.org</a>><br>Cc: <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a> <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>>, <a href="mailto:openid-specs-fapi-owner@lists.openid.net">openid-specs-fapi-owner@lists.openid.net</a> <<a href="mailto:openid-specs-fapi-owner@lists.openid.net">openid-specs-fapi-owner@lists.openid.net</a>>, Gail Hodges <<a href="mailto:gail@oidf.org">gail@oidf.org</a>><br></div><br><br><div class="msg1727940805572728536">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello AB/Connect & FAPI WG Co-Chairs & Contributors,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
This is a friendly reminder to review and provide comments on OWASP's updated Application Security Verification Standard per Mark Haine's email below.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
WG co-chairs — please add this topic/reminder to your upcoming call agendas.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Kind regards,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Mike</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="m_-1588271374430828453Signature">
<p style="text-align:left;background-color:rgb(255,255,255);margin:0in 0in 0.0001pt;font-family:Cambria;font-size:12pt">
<span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(127,127,127)">MIKE LESZCZ
</span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(255,102,0)">:</span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(127,127,127)"> OPERATIONS DIRECTOR
</span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(255,102,0)">:
</span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(127,127,127)">OPENID FOUNDATION</span></p>
<p style="text-align:left;background-color:rgb(255,255,255);margin:0in 0in 0.0001pt;font-family:Cambria;font-size:12pt">
<span style="font-family:Helvetica,sans-serif;font-size:8pt;color:blue"><u><a href="mailto:mike.leszcz@oidf.org" id="m_-1588271374430828453OWA9dec0a44-184f-84af-abde-2b6e0ccbea6b" style="color:blue;margin:0px" target="_blank">mike.leszcz@oidf.org</a></u></span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(0,0,0)"> </span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(255,102,0)">:
</span><span style="font-family:Helvetica,sans-serif;font-size:8pt;color:rgb(127,127,127)">+1 803.239.7750</span></p>
</div>
<div id="m_-1588271374430828453appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<hr style="display:inline-block;width:98%">
<div id="m_-1588271374430828453divRplyFwdMsg" dir="ltr"><span style="font-family:Calibri,sans-serif;font-size:11pt;color:rgb(0,0,0)"><b>From:</b> Nat Sakimura <<a href="mailto:nat@sakimura.org" target="_blank">nat@sakimura.org</a>><br>
<b>Sent:</b> Monday, March 3, 2025 7:49 AM<br>
<b>To:</b> Mark Haine <<a href="mailto:Mark.Haine@oidf.org" target="_blank">Mark.Haine@oidf.org</a>><br>
<b>Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a> <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>; <a href="mailto:openid-specs-fapi-owner@lists.openid.net" target="_blank">openid-specs-fapi-owner@lists.openid.net</a> <<a href="mailto:openid-specs-fapi-owner@lists.openid.net" target="_blank">openid-specs-fapi-owner@lists.openid.net</a>>; Gail Hodges <<a href="mailto:gail@oidf.org" target="_blank">gail@oidf.org</a>>; Mike Leszcz <<a href="mailto:mike.leszcz@oidf.org" target="_blank">mike.leszcz@oidf.org</a>><br>
<b>Subject:</b> Re: OWASP ASVS 5.0</span>
<div> </div>
</div>
<div style="direction:ltr">Thanks for sharing! </div>
<div style="direction:ltr">It is important to provide feedback IMHO.</div>
<br>
<div style="direction:ltr">2025年3月3日(月) 21:47 Mark Haine <<a href="mailto:Mark.Haine@oidf.org" id="m_-1588271374430828453OWAa85af8bf-280e-14c6-c318-f8072dda0730" target="_blank">Mark.Haine@oidf.org</a>>:</div>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<p>Hi AB/Connect and FAPI people,</p>
<p> </p>
<p>There was a presentation at OSW2025 where I learned that OWASP are working on a major revision to their Application Security Verification Standard. As part of that revision, they are adding content relating to “OAuth and OIDC” (sic). Some of you might
wish to review and provide comment. If having an OIDF set of collated feedback is desirable I may be able to find time to aggregate your thoughts and comments. If that is the case please let me know. I shall do my best to review for the OIDF in any case.</p>
<p> </p>
<p><a href="https://github.com/OWASP/ASVS/tree/master" id="m_-1588271374430828453OWAba55270f-ab66-67fb-2b65-4a41e0732cb5" style="margin-top:0px;margin-bottom:0px" target="_blank">https://github.com/OWASP/ASVS/tree/master</a></p>
<p><img id="m_-1588271374430828453x_m_-4212307068283882587Picture_x0020_1" width="432" height="108" size="1552413" style="width:4.5in;height:1.125in;margin-top:0px;margin-bottom:0px" src="cid:ii_1958ae1f2134ce8e91"></p>
<p> </p>
<p>Specific section on OAuth and OIDC is in:</p>
<p><a href="https://github.com/OWASP/ASVS/blob/master/5.0/en/0x51-V51-OAuth2.md" id="m_-1588271374430828453OWA8bdaaed7-2a9b-dfb9-8d7b-ec8a0eb659a0" style="margin-top:0px;margin-bottom:0px" target="_blank">https://github.com/OWASP/ASVS/blob/master/5.0/en/0x51-V51-OAuth2.md</a></p>
<p> </p>
<p>I have reached out to the presenter to see if there is any other guidance for reviewers. If I get anything back I’ll add it to this mail thread.</p>
<p> </p>
<p>Best Regards,</p>
<p> </p>
<p> </p>
<p><span style="font-family:Calibri,sans-serif;color:rgb(33,33,33)">Mark Haine</span></p>
<p><span style="font-family:Calibri,sans-serif;color:rgb(33,33,33)"> </span></p>
<p><span style="font-family:Calibri,sans-serif;color:rgb(0,120,215)"><a href="tel:+447775550344" id="m_-1588271374430828453OWA88249cca-a23c-d14f-2995-572af9fecd8c" style="color:rgb(0,120,215);margin-top:0px;margin-bottom:0px" target="_blank">+44
(0) 777 555 0344</a></span><span style="font-family:Calibri,sans-serif;color:black"> |
</span><span style="font-family:Calibri,sans-serif;color:rgb(5,99,193)"><a href="mailto:mark.haine@oidf.org" id="m_-1588271374430828453OWA6a6cb241-046f-e1b6-f6f7-76f3b96d5d36" style="color:rgb(5,99,193);margin-top:0px;margin-bottom:0px" target="_blank">mark.haine@oidf.org</a></span><span style="font-family:Calibri,sans-serif;color:black"> | </span></p>
<p><span style="font-family:Calibri,sans-serif;font-size:12pt;color:black"><a href="https://www.considrd.consulting/" id="m_-1588271374430828453OWAb42238b7-739d-329a-cc73-08f7781443ec" title="https://www.considrd.consulting/" style="color:black;margin-top:0px;margin-bottom:0px" target="_blank"><img alt="OpenID Logo" id="m_-1588271374430828453x_m_-4212307068283882587Picture_x0020_2" width="151" height="48" size="6345" style="width:1.5833in;height:0.5in;margin-top:0px;margin-bottom:0px" src="cid:ii_1958ae1f2135b16b22"></a></span></p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
</blockquote>
</div>
</div></div></div></div>