<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="font: 14px/1.4285714 Arial, sans-serif; color: #333;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td style="background: #f5f5f5; padding: 10px 10px 0; font: 14px/1.4285714 Arial, sans-serif;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td id="main" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; background-color: #fff; border-radius: 5px">
<div style="border: 1px solid #ccc; border-radius: 5px; padding: 20px">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td style="font: 14px/1.4285714 Arial, sans-serif; padding: 0">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td id="avatar" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; width: 32px; vertical-align: top">
<img width="32" height="32" alt="josephheenan" src="https://avatar-cdn.atlassian.com/1da560611125a1b7d15951a0890a5ad6?s=32&ts=1516528587" style="border-radius: 3px">
</td>
<td id="content" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0 0 0 10px">
<table style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<td class="user-action" style="font: 14px/1.4285714 Arial, sans-serif; padding: 0; line-height: 1">
<span><strong>Joseph Heenan</strong> created pull request #42: </span></td>
</tr>
<tr>
<td class="title" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px 0 0; font-weight: bold; line-height: 1.2">
<a href="https://bitbucket.org/openid/fapi/pull-requests/42/part-2-require-redirect_uri-to-be-inside" style="color: #3572b0; text-decoration: none">Part 2: Require redirect_uri to be inside signed request object</a>
</td>
</tr>
<tr>
<td class="markup-content" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 15px">
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0; margin-top: 0">fixes <a href="https://bitbucket.org/openid/fapi/issues/128/redirect_uri-in-url-query-vs-request" rel="nofollow" title="redirect_uri in url query vs request object" style="color: #3572b0; text-decoration: none">
#128</a> (or at least fixes the only part it seems we can current fix)</p>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">This should help mitigate any attacks that require changing the redirect_uri.</p>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">The redirect_uri appears to still be required as a parameter outside the request object for compliance with the current underlying OAuth RFC (although my personal opinion is that this is not clearly
stated in the specifications).</p>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">The OIDC Core spec is already clear on behaviour in the case where redirect_uri is present in both location:</p>
<p style="margin-bottom: 0; margin: 10px 0 0; padding: 0">"When the request parameter is used, the OpenID Connect request parameter values contained in the JWT supersede those passed using the OAuth 2.0 request syntax."</p>
</td>
</tr>
<tr>
<td class="commit-list-container after-markup" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 20px">
<table class="commit-list" style="width: 100%; border-collapse: collapse">
<tbody>
<tr>
<th class="user" style="border-bottom: 1px solid #ccc; text-align: left; font-weight: bold; padding: 5px; width: 132px">
Author</th>
<th class="commit" style="border-bottom: 1px solid #ccc; text-align: left; font-weight: bold; padding: 5px; width: 50px">
Commit</th>
<th class="message" style="border-bottom: 1px solid #ccc; text-align: left; font-weight: bold; padding: 5px">
Message</th>
<th class="date" style="border-bottom: 1px solid #ccc; text-align: left; font-weight: bold; padding: 5px; width: 100px">
Date</th>
</tr>
<tr>
<td class="user" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px; border-bottom: 1px solid #ccc; line-height: 24px; color: #707070; width: 132px">
<img height="24" width="24" alt="josephheenan" src="https://avatar-cdn.atlassian.com/1da560611125a1b7d15951a0890a5ad6?s=24&ts=1516528587" style="vertical-align: top; border-radius: 3px">
<span style="padding: 0 0 0 5px">Joseph Heenan</span> </td>
<td class="commit" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px; border-bottom: 1px solid #ccc; line-height: 24px; color: #707070; width: 50px; font-family: Monaco, monospace; font-size: 12px">
<a href="https://bitbucket.org/josephheenan/fapi/commits/cbb97689d05ce7407a800870e4b6d907cdfac016" style="color: #3572b0; text-decoration: none">cbb9768</a>
</td>
<td class="message" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px; border-bottom: 1px solid #ccc; line-height: 24px; color: #707070">
Part 2: Require redirect_uri to be inside signed request object </td>
<td class="date" style="font: 14px/1.4285714 Arial, sans-serif; padding: 5px; border-bottom: 1px solid #ccc; line-height: 24px; color: #707070; width: 100px">
<div>21 Jan 2018 </div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td class="actions" colspan="2" style="font: 14px/1.4285714 Arial, sans-serif; padding: 10px 0 0; border-top: 1px solid #ccc; line-height: 1">
<a href="https://bitbucket.org/openid/fapi/pull-requests/42/part-2-require-redirect_uri-to-be-inside" style="color: #3572b0; text-decoration: none">View this pull request</a> or add a comment by replying to this email.
</td>
</tr>
</tbody>
</table>
</div>
<div itemscope="" itemtype="http://schema.org/EmailMessage" style="border: 1px solid #ccc; border-radius: 5px; padding: 20px; display: none">
<div itemprop="potentialAction" itemscope="" itemtype="http://schema.org/ViewAction">
<link itemprop="target" href="https://bitbucket.org/openid/fapi/pull-requests/42/part-2-require-redirect_uri-to-be-inside">
<meta itemprop="name" content="View pull request">
</div>
<meta itemprop="description" content="View this pull request on Bitbucket">
</div>
</td>
</tr>
<tr>
<td style="padding: 20px 0; color: #707070;">
<table style="width: 100%; border-collapse: collapse;">
<tbody>
<tr>
<td style="padding: 0"><a style="color: #3572b0; text-decoration: none;" href="https://bitbucket.org/openid/fapi/pull-requests/42/unsubscribe/openid/45f9b421bad3d53a207aedcac31f7c480c8119dd/">Unsubscribe from pull request emails</a> for this repository.
</td>
<td style="padding: 0"><img width="1" height="1" src="https://bitbucket.org/account/notifications/mark-read/819495565/9faa38743f03be5f8f432cf3759cc0be283c943c/">
</td>
<td style="text-align: right; width: 100px; padding: 0"><a href="https://bitbucket.org" style="color: #3572b0; text-decoration: none;"><img width="125" height="18" src="https://d301sr5gafysq2.cloudfront.net/8b6d2e54d3e9/img/email/bitbucket-footer.gif" alt="Bitbucket">
</a></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</body>
</html>