<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:"Trebuchet MS";
panose-1:2 11 6 3 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">just a small thing…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">I think that in
</span><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US"><a href="https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html"><span lang="EN-US">https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html</span></a></span><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">
</span><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">this
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:36.0pt"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">"</span>All TLS connections between web browsers, clients, authorization servers, and resource servers shall be protected against network
attackers.<span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">should read
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">
</span><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">"</span>All
<b><span lang="EN-US">network</span></b> connections between web browsers, clients, authorization servers, and resource servers shall be protected against network attackers.<span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">Kind regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;mso-fareast-language:EN-US">Axel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-US" style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span lang="EN-US" style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Gail Hodges via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br>
<b>Date: </b>Wednesday, 20. December 2023 at 19:34<br>
<b>To: </b>FAPI Working Group List <openid-specs-fapi@lists.openid.net><br>
<b>Cc: </b>Gail Hodges <gail@oidf.org><br>
<b>Subject: </b>Re: [Openid-specs-fapi] Last FAPI2 Issue and PR<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Dave - Thanks for the recap.
</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">FAPI WG team – I hope you can respond to this new PR as Dave requests so we can move to Last Call in first meeting of new year!
</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Gail </span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-US" style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">From:
</span></b><span lang="EN-US" style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:black">Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Dave Tonge via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br>
<b>Date: </b>Wednesday, December 20, 2023 at 7:00 AM<br>
<b>To: </b>Openid-specs Fapi <openid-specs-fapi@lists.openid.net><br>
<b>Cc: </b>Dave Tonge <dave.tonge@momentumft.co.uk><br>
<b>Subject: </b>[Openid-specs-fapi] Last FAPI2 Issue and PR</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">Dear FAPI WG</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">We have closed off all legacy issues and PRs on FAPI 2.0 Attacker Model and Security Profile.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">However we received some implementation feedback last week that we discussed on the call and decided needs addressing.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">The relevant issue is here: <a href="https://bitbucket.org/openid/fapi/issues/635/one-time-use-of-request_uri-causing-error">https://bitbucket.org/openid/fapi/issues/635/one-time-use-of-request_uri-causing-error</a></span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">We discussed on the call today and I've opened this PR: <a href="https://bitbucket.org/openid/fapi/pull-requests/454">https://bitbucket.org/openid/fapi/pull-requests/454</a></span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">I will also raise the issue in the OAuth WG as it could affect other PAR implementations. </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">Although we have no more calls this year, it would be great if those who are still working are able to review the above PRs so that we can close on the first
call in the new year and move to the working group last call. I'm very open to alternative text suggestions, my aim was to keep it as more of an implementation note rather than normative text.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">Thank you</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">Dave</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Trebuchet MS",sans-serif">FAPI WG Co-Chair</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p><span lang="EN-US" style="font-size:7.5pt">Moneyhub Enterprise is a trading style of Moneyhub Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Moneyhub Financial Technology is entered on the Financial
Services Register (FRN 809360) at <a href="https://register.fca.org.uk/" target="_blank">
https://register.fca.org.uk/</a>. Moneyhub Financial Technology is registered in England & Wales, company registration number 06909772. Registered address: C/O Roxburgh Milkins Limited Merchants House North, Wapping Road, Bristol, United Kingdom, BS1 4RW, United
Kingdom. Moneyhub Financial Technology Limited 2022 © Moneyhub Enterprise.</span><span lang="EN-US"><o:p></o:p></span></p>
<p><span lang="EN-US" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other
than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company
may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Moneyhub Financial Technology Limited
or of any other group company.</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span lang="EN-US"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>