<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Right. But an attacker simply can’t inject that state value into the authorization endpoint call (because in FAPI1-Adv that call uses a signed object that the OP can detect tampering with), so what can the OP usefully do - it can only prevent the RP from attacking the RP?<div><br></div><div>Joseph</div><div><br><div><br><blockquote type="cite"><div>On 16 Jun 2023, at 16:43, Piotr M DROZD <piotr.m.drozd@hsbc.com> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US">I apologize for miss sent email.<o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US">My worry is current pattern VSCHAR = %x20-7E allow to use as state parameter value of format:<o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span>?state=><script>if (window.confirm('If you click "ok" you would be redirected . Cancel will load this website ')) {window.location.href='<a href="https://www.google.com/" style="color: blue; text-decoration: underline;">https://www.google.com/</a>';};</script><o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US">In case of poor coding at RP when there is middle page to resubmit state and code parameter to server it is possible to execute state value as actual script (old way of submitting data thru hidden input field inside html form)<o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US">BR,<o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-family: Arial, sans-serif; color: red;">Piotr DROZD</span></b><span style=""><o:p></o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">Global Platform Lead – WSIT Open Banking</span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">Wholesale IT l HSBC SERVICE DELIVERY(P</span><span lang="EN-US" style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">L</span><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">)</span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"> </span><span style=""><o:p></o:p></span></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left: 4.35pt; border-collapse: collapse;"><tbody><tr><td width="375" style="width: 281.25pt; padding: 0.75pt;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">______________________________________________________________</span><o:p></o:p></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="99%" style="width: 375.5px; margin-left: 0.25pt; border-collapse: collapse;"><tbody><tr><td width="17%" style="width: 64.484375px; padding: 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;"> </span></b><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;">Telephone:</span></b><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;">Internal:</span></b><o:p></o:p></div></td><td width="82%" style="width: 311.03125px; padding: 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">N/A</span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">604857122580</span><o:p></o:p></div></td></tr><tr><td width="17%" style="width: 64.484375px; padding: 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;">Email:</span></b><o:p></o:p></div></td><td width="82%" style="width: 311.03125px; padding: 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><u><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;"><a href="mailto:piotr.m.drozd@hsbc.com" title="mailto:piotr.m.drozd@hsbc.com" style="color: blue; text-decoration: underline;"><span style="color: rgb(149, 79, 114);">piotr.m.drozd@hsbc.com</span></a></span></u><o:p></o:p></div></td></tr></tbody></table><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">______________________________________________________________</span><o:p></o:p></div></td></tr></tbody></table></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"><o:p> </o:p></span></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 12pt;">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;">Openid-specs-fapi <<a href="mailto:openid-specs-fapi-bounces@lists.openid.net" style="color: blue; text-decoration: underline;">openid-specs-fapi-bounces@lists.openid.net</a>> on behalf of Piotr M DROZD via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net" style="color: blue; text-decoration: underline;">openid-specs-fapi@lists.openid.net</a>><br><b>Reply to:<span class="Apple-converted-space"> </span></b>FAPI Working Group List <<a href="mailto:openid-specs-fapi@lists.openid.net" style="color: blue; text-decoration: underline;">openid-specs-fapi@lists.openid.net</a>><br><b>Date:<span class="Apple-converted-space"> </span></b>Friday, 16 June 2023 at 17:39<br><b>To:<span class="Apple-converted-space"> </span></b>Joseph Heenan <<a href="mailto:joseph@authlete.com" style="color: blue; text-decoration: underline;">joseph@authlete.com</a>>, Financial API Working Group List <<a href="mailto:openid-specs-fapi@lists.openid.net" style="color: blue; text-decoration: underline;">openid-specs-fapi@lists.openid.net</a>><br><b>Cc:<span class="Apple-converted-space"> </span></b>Piotr M DROZD <<a href="mailto:piotr.m.drozd@hsbc.com" style="color: blue; text-decoration: underline;">piotr.m.drozd@hsbc.com</a>><br><b>Subject:<span class="Apple-converted-space"> </span></b>EXTERNAL: Re: [Openid-specs-fapi] Re: XSS - FAPI/OpenID - query<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">My worry in case of current pattern From: Joseph Heenan <joseph@ authlete. com> Date: Friday, 16 June 2023 at 17: 31 To: Financial API Working Group List <openid-specs-fapi@ lists. openid. net> Cc: Piotr M DROZD <piotr. m. drozd@ hsbc. com><span class="Apple-converted-space"> </span><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">ZjQcmQRYFpfptBannerStart<o:p></o:p></span></div></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width: 1208px; border-radius: 4px;"><tbody><tr><td style="padding: 12pt 0cm;"><table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="100%" style="width: 1208px; background: rgb(252, 236, 166); border-width: 3pt medium medium; border-style: solid none none; border-color: rgb(228, 202, 0) currentcolor currentcolor; border-image: none;"><tbody><tr><td valign="top" style="border: medium; padding: 0cm 7.5pt 3.75pt 4.5pt;"><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left"><tbody><tr><td style="padding: 3pt 6pt;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 10.5pt; font-family: Arial, sans-serif;">This Message Is From an External Sender<o:p></o:p></span></b></div></td></tr><tr><td style="padding: 3pt 6pt;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 9pt; font-family: Arial, sans-serif;">This message came from outside your organisation. The content & any attachments need to be treated with care and attention.<o:p></o:p></span></div></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">ZjQcmQRYFpfptBannerEnd<o:p></o:p></span></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US">My worry in case of current pattern</span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"> </span><o:p></o:p></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span> </span><o:p></o:p></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 12pt;">From:<span class="Apple-converted-space"> </span></span></b><span style="font-size: 12pt;">Joseph Heenan <joseph@authlete.com><br><b>Date:<span class="Apple-converted-space"> </span></b>Friday, 16 June 2023 at 17:31<br><b>To:<span class="Apple-converted-space"> </span></b>Financial API Working Group List <openid-specs-fapi@lists.openid.net><br><b>Cc:<span class="Apple-converted-space"> </span></b>Piotr M DROZD <piotr.m.drozd@hsbc.com><br><b>Subject:<span class="Apple-converted-space"> </span></b>EXTERNAL: Re: [Openid-specs-fapi] XSS - FAPI/OpenID - query</span><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">Hi Piotr Thanks for your email. For info, the syntax for state is defined here: https: //www. rfc-editor. org/rfc/rfc6749#appendix-A. 5 If I have understood correctly, the issue you are raising is that the RP may due to poor coding display values<span class="Apple-converted-space"> </span></span><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">ZjQcmQRYFpfptBannerStart</span><o:p></o:p></div></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width: 1208px; border-radius: 4px;"><tbody><tr><td style="padding: 12pt 0cm;"><table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="100%" style="width: 1208px; background: rgb(252, 236, 166); border-width: 3pt medium medium; border-style: solid none none; border-color: rgb(228, 202, 0) currentcolor currentcolor; border-image: none;"><tbody><tr><td valign="top" style="border: medium; padding: 0cm 7.5pt 3.75pt 4.5pt;"><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left"><tbody><tr><td style="padding: 3pt 6pt;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 10.5pt; font-family: Arial, sans-serif;">This Message Is From an Untrusted Sender</span></b><o:p></o:p></div></td></tr><tr><td style="padding: 3pt 6pt;"><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 9pt; font-family: Arial, sans-serif;">You have not previously corresponded with this sender.</span><o:p></o:p></div></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 1pt; color: white;">ZjQcmQRYFpfptBannerEnd</span><o:p></o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Hi Piotr<span class="Apple-converted-space"> </span><o:p></o:p></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks for your email.<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">For info, the syntax for state is defined here:<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><a href="https://urldefense.com/v3/__https:/www.rfc-editor.org/rfc/rfc6749*appendix-A.5__;Iw!!LSAcJDlP!2EmCh3VXFjRePTUDoI0aA3Q1C1eMPSfPsVIru2Pyt1XhBwdkRu7YlA7k_RSovTBHK562C7e0328QCwPfD8c$" style="color: blue; text-decoration: underline;">https://www.rfc-editor.org/rfc/rfc6749#appendix-A.5</a><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">If I have understood correctly, the issue you are raising is that the RP may due to poor coding display values passed in the URL query to it’s redirect url without proper escaping?<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">I do not seen what the OP can usefully do here, at least in the case of FAPI (where the state/nonce values are passed to the OP cryptographically signed and hence are known to have come from the RP).<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Joseph<o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">On 16 Jun 2023, at 16:13, Piotr M DROZD via Openid-specs-fapi <openid-specs-fapi@lists.openid.net> wrote:<o:p></o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div><div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span lang="EN-US"> </span>Hi,<o:p></o:p></div></div><p style="margin-bottom: 0cm; caret-color: rgb(0, 0, 0); font-variant-caps: normal; text-align: start; -webkit-text-stroke-width: 0px; word-spacing: 0px;"><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">As currently we do not have access to bitbucket to rise issue/queries I would like to seek members to rise below query/issue as a ticket that we can discuss on FAPI Weekly Working Group and reach a common conclusion.</span><o:p></o:p></p><p style="margin-bottom: 0cm; font-variant-caps: normal; text-align: start; -webkit-text-stroke-width: 0px; caret-color: rgb(0, 0, 0); word-spacing: 0px;"><span style="font-size: 9pt; font-family: Helvetica;">In current specification of<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">FAPI/OpenID (both 1 draft 06, 1 final, and 2.0)<span class="apple-converted-space"> </span></span><span style="font-size: 9pt; font-family: Helvetica;">during<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">Authentication/Authorization Request, RP (Relaying Party) can</span><span class="apple-converted-space"><span style="font-size: 9pt; font-family: Helvetica;"> </span></span><span style="font-size: 9pt; font-family: Helvetica;">sent state</span><span class="apple-converted-space"><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">and nonce query<span class="apple-converted-space"> </span></span><span style="font-size: 9pt; font-family: Helvetica;">parameter<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">as</span><span class="apple-converted-space"><span style="font-size: 9pt; font-family: Helvetica;"> </span></span><span style="font-size: 9pt; font-family: Helvetica;">opaque string value –<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">both parameters do not have any validation rules</span><span style="font-size: 9pt; font-family: Helvetica;">. According to OWASP<span class="apple-converted-space"> </span></span><span lang="PL" style="font-size: 9pt; font-family: Helvetica;"><a href="https://urldefense.com/v3/__https:/owasp.org/www-community/attacks/xss/__;!!LSAcJDlP!2EmCh3VXFjRePTUDoI0aA3Q1C1eMPSfPsVIru2Pyt1XhBwdkRu7YlA7k_RSovTBHK562C7e0328Qb6xvBp8$" title="https://owasp.org/www-community/attacks/xss/" style="color: blue; text-decoration: underline;"><span lang="EN-US" style="color: rgb(5, 99, 193);">https://owasp.org/www-community/attacks/xss/</span></a><span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">t</span><span style="font-size: 9pt; font-family: Helvetica;">here are cases whe</span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">n</span><span class="apple-converted-space"><span style="font-size: 9pt; font-family: Helvetica;"> </span></span><span style="font-size: 9pt; font-family: Helvetica;">query parameter can be used for XSS attack. </span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">In case of Browser journey when RP (Relaying Party) is using server side based rendered html pages without proper parameter sanitization it is possible to perform such an attack.<span class="apple-converted-space"> </span></span><o:p></o:p></p><p style="margin-bottom: 0cm;"><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">I can walkthrough example code to demonstrate issue if further clarification will be required to understand Use Case.</span><o:p></o:p></p><p style="margin-bottom: 0cm; font-variant-caps: normal; text-align: start; -webkit-text-stroke-width: 0px; caret-color: rgb(0, 0, 0); word-spacing: 0px;"><span style="font-size: 9pt; font-family: Helvetica;">I would like to seek<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 9pt; font-family: Helvetica;">your opinion:</span><o:p></o:p></p><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm; font-variant-caps: normal; text-align: start; -webkit-text-stroke-width: 0px; caret-color: rgb(0, 0, 0); word-spacing: 0px;"><li class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Could<span class="apple-converted-space"> </span>OpenID Provider (OP)<span class="apple-converted-space"> </span>add protection layer for XSS which in the end will mean state<span lang="EN-US">,nonce</span><span class="apple-converted-space"> </span>parameter<span class="apple-converted-space"> </span><span lang="EN-US">could</span><span class="apple-converted-space"> </span>be validated<span class="apple-converted-space"> </span><span lang="EN-US">against allowed<span class="apple-converted-space"> </span></span>Pattern<span class="apple-converted-space"> </span><span lang="EN-US">– example -<span class="apple-converted-space"> </span></span> ^[-\p{L}\p{N}./+=_ !$*?@%:,]{0,2000}$ or<span class="apple-converted-space"> </span>will this<span class="apple-converted-space"><span lang="EN-US"> </span></span><span lang="EN-US">break conformance to FAPI/OpenID<span class="apple-converted-space"> </span></span>specification ?<o:p></o:p></li><li class="MsoNormal" style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">Should general OWASP protection rules become embedded inside<span class="apple-converted-space"> </span><span lang="EN-US">FAPI/OpenID</span><span class="apple-converted-space"> </span>specification ?<o:p></o:p></li></ul><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-family: Arial, sans-serif; color: red;">Piotr DROZD</span></b><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">Global Platform Lead – WSIT Open Banking</span><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">Wholesale IT l HSBC SERVICE DELIVERY(P</span><span lang="EN-US" style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">L</span><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">)</span><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left: 4.35pt; border-collapse: collapse;"><tbody><tr><td width="375" style="width: 281.25pt; padding: 0.75pt;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">______________________________________________________________</span><o:p></o:p></div></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="99%" style="width: 375.5px; margin-left: 0.25pt; border-collapse: collapse;"><tbody><tr><td width="17%" style="width: 64.484375px; padding: 0cm;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;"> </span></b><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;">Telephone:</span></b><o:p></o:p></div></div></td><td width="82%" style="width: 311.03125px; padding: 0cm;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);"> </span><o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">N/A</span><o:p></o:p></div></div></td></tr><tr><td width="17%" style="width: 64.484375px; padding: 0cm;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;">Email:</span></b><o:p></o:p></div></div></td><td width="82%" style="width: 311.03125px; padding: 0cm;"><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><u><span style="font-size: 8pt; font-family: Arial, sans-serif; color: red;"><a href="mailto:piotr.m.drozd@hsbc.com" title="mailto:piotr.m.drozd@hsbc.com" style="color: blue; text-decoration: underline;"><span style="color: rgb(149, 79, 114);">piotr.m.drozd@hsbc.com</span></a></span></u><o:p></o:p></div></div></td></tr></tbody></table><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 8pt; font-family: Arial, sans-serif; color: rgb(31, 73, 125);">______________________________________________________________</span><o:p></o:p></div></div></td></tr></tbody></table></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 9pt; font-family: Helvetica;">-----------------------------------------<br>SAVE PAPER - THINK BEFORE YOU PRINT!<br><br>This E-mail is confidential.<span class="apple-converted-space"> </span><br><br>It may also be legally privileged. If you are not the addressee you may not copy,<br>forward, disclose or use any part of it. If you have received this message in error,<br>please delete it and all copies from your system and notify the sender immediately by<br>return E-mail.<br><br>Internet communications cannot be guaranteed to be timely secure, error or virus-free.<br>The sender does not accept liability for any errors or omissions.</span><o:p></o:p></div></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 9pt; font-family: Helvetica;">_______________________________________________<br>Openid-specs-fapi mailing list<br></span><a href="mailto:Openid-specs-fapi@lists.openid.net" style="color: blue; text-decoration: underline;"><span style="font-size: 9pt; font-family: Helvetica; color: rgb(5, 99, 193);">Openid-specs-fapi@lists.openid.net</span></a><span style="font-size: 9pt; font-family: Helvetica;"><br></span><a href="https://urldefense.com/v3/__https:/lists.openid.net/mailman/listinfo/openid-specs-fapi__;!!LSAcJDlP!2EmCh3VXFjRePTUDoI0aA3Q1C1eMPSfPsVIru2Pyt1XhBwdkRu7YlA7k_RSovTBHK562C7e0328QQ5XgPtQ$" style="color: blue; text-decoration: underline;"><span style="font-size: 9pt; font-family: Helvetica; color: rgb(5, 99, 193);">https://lists.openid.net/mailman/listinfo/openid-specs-fapi</span></a><o:p></o:p></div></div></blockquote></div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div></div><div><div style="margin: 0cm; font-size: 11pt; font-family: Calibri, sans-serif;">-----------------------------------------<br>SAVE PAPER - THINK BEFORE YOU PRINT!<br><br>This E-mail is confidential.<span class="Apple-converted-space"> </span><br><br>It may also be legally privileged. If you are not the addressee you may not copy,<br>forward, disclose or use any part of it. If you have received this message in error,<br>please delete it and all copies from your system and notify the sender immediately by<br>return E-mail.<br><br>Internet communications cannot be guaranteed to be timely secure, error or virus-free.<br>The sender does not accept liability for any errors or omissions.<o:p></o:p></div></div></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">-----------------------------------------<br>SAVE PAPER - THINK BEFORE YOU PRINT!<br><br>This E-mail is confidential.<span class="Apple-converted-space"> </span><br><br>It may also be legally privileged. If you are not the addressee you may not copy,<br>forward, disclose or use any part of it. If you have received this message in error,<br>please delete it and all copies from your system and notify the sender immediately by<br>return E-mail.<br><br>Internet communications cannot be guaranteed to be timely secure, error or virus-free.<br>The sender does not accept liability for any errors or omissions.</div></div></blockquote></div><br></div></body></html>