<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="font: 14px/1.4285714 Arial, sans-serif; color: #333;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td style="background: #f5f5f5; padding: 10px 10px 0; font: 14px/1.4285714 Arial, sans-serif;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td id="main" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; background-color: #fff; border-radius: 5px">
<div style="border: 1px solid #ccc; border-radius: 5px; padding: 20px">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td style="font: 14px/1.4285714 Arial, sans-serif; padding: 0">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td id="avatar" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 32px; vertical-align: top">
<img width="32" height="32" alt="josephheenan-fintech" src="https://avatar-cdn.atlassian.com/23405e7dd1c78b098886ac4ea5086e9b?s=32&ts=1505310378" style="border-radius: 3px">
</td>
<td id="content" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0 0 0 10px">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td class="user-action" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; line-height: 1">
<span><strong>Joseph Heenan</strong> created issue #123: </span></td>
</tr>
<tr>
<td class="title" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px 0 0; font-weight: bold; line-height: 1.2">
<a href="https://bitbucket.org/openid/fapi/issues/123/is-it-okay-for-request-object-urns-to-be" style="color: #3572b0; text-decoration: none">Is it okay for request object URNs to be predictable?</a>
</td>
</tr>
<tr>
<td class="markup-content" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 15px">
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0; margin-top: 0">FAPI part 2 7.1 currently says:</p>
<div class="codehilite language-markdown">
<pre style="margin: 10px 0 0; border: 1px solid #ccc; border-radius: 5px; background: #f5f5f5; padding: 10px"><span></span>Note that `request_uri` can be either URL or URN.
If it is a URL, it shall be based on a cryptographic random value so that it is difficult to predict for an attacker.
</pre>
</div>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">This would seem to imply that if a URN is used it is okay for the URN to be predictable.</p>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">I am not 100% certain that is the case (perhaps an attacker could cause a DoS by attempting to use other people's URNs, as the URNs are meant to be one-time use? Though this probably requires at least
a partial compromise of the client credentials too).</p>
</td>
</tr>
<tr>
<td style="font: 14px/1.4285714 Arial, sans-serif; padding: 0">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td class="list-label" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; color: #707070; padding-right: 10px; vertical-align: top; white-space: nowrap">
Type:</td>
<td class="list-value" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 100%">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td class="type-icon" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 16px">
<img src="https://d301sr5gafysq2.cloudfront.net/4373ea877c7d/img/icons/jira/bug.png" alt="" height="16" width="16" style="margin-top: 2px; margin-right: 5px">
</td>
<td style="font: 14px/1.4285714 Arial, sans-serif; padding: 0">bug </td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td class="list-label" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; color: #707070; padding-right: 10px; vertical-align: top; white-space: nowrap">
Priority:</td>
<td class="list-value" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 100%">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td class="priority-icon" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 16px">
<img src="https://d301sr5gafysq2.cloudfront.net/4373ea877c7d/img/icons/jira/priority_major.png" alt="" height="16" width="16" style="margin-top: 2px; margin-right: 5px">
</td>
<td style="font: 14px/1.4285714 Arial, sans-serif; padding: 0">major </td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td class="list-label" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; color: #707070; padding-right: 10px; vertical-align: top; white-space: nowrap">
Component:</td>
<td class="list-value" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 100%">
Part 2: RW Security </td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td class="spacer" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 0">
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td class="actions" colspan="2" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 0; border-top: 1px solid #ccc; line-height: 1">
<a href="https://bitbucket.org/openid/fapi/issues/123/is-it-okay-for-request-object-urns-to-be" style="color: #3572b0; text-decoration: none">View this issue</a> or add a comment by replying to this email.
</td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr>
<td style="padding: 20px 0; color: #707070;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td style="padding: 0"><a style="color: #3572b0; text-decoration: none;" href="https://bitbucket.org/api/1.0/repositories/openid/fapi/issue/123/unsubscribe/openid/df2bfe7836723d6e685249a416e7c899130d4b87/">Unsubscribe from issue emails</a> for this repository.
</td>
<td style="padding: 0"><img width="1" height="1" src="https://bitbucket.org/account/notifications/mark-read/687667096/c70c5b61c4b027c9175194448cbc0620ee7d01ce/">
</td>
<td style="text-align: right; width: 100px; padding: 0"><a href="https://bitbucket.org" style="color: #3572b0; text-decoration: none;"><img width="125" height="18" src="https://d301sr5gafysq2.cloudfront.net/4373ea877c7d/img/email/bitbucket-footer.gif" alt="Bitbucket">
</a></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</body>
</html>