<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Mike<div><br></div><div>You can see some of the discussion (and links to further discussion) here: <a href="https://bitbucket.org/openid/fapi/issues/674/length-of-nonce-tested-in-op-conformance">https://bitbucket.org/openid/fapi/issues/674/length-of-nonce-tested-in-op-conformance</a></div><div><br></div><div>There are some hard limits enforced in the FAPI certification tests for both state and nonce, e.g. a 64 character nonce is required to be accepted by the OP (and I think we warn (but not fail) if the RP uses over 64 characters in nonce).</div><div><br></div><div>Joseph</div><div><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 3 Oct 2025, at 18:56, Michael Jones via Openid-specs-fapi <openid-specs-fapi@lists.openid.net> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">There’s a request in OpenID Connect to define size limits for some parameters at<a href="https://bitbucket.org/openid/connect/issues/2183/openid-connect-session-management-10-and" style="color: rgb(70, 120, 134); text-decoration: underline;">https://bitbucket.org/openid/connect/issues/2183/openid-connect-session-management-10-and</a>.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Anecdotally, I’m told that FAPI discussed adding size limits and decided not to do so.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Indeed, there is one counterexample at<span class="Apple-converted-space"> </span><a href="https://openid.net/specs/fapi-security-profile-2_0.html#section-5.3.2.2-6" style="color: rgb(70, 120, 134); text-decoration: underline;">https://openid.net/specs/fapi-security-profile-2_0.html#section-5.3.2.2-6</a><span class="Apple-converted-space"> </span>where the spec says that a parameter may be large but doesn’t try to limit its size.<o:p></o:p></span></div><div style="margin: 0in 0in 0in 0.5in; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span style="font-size: 11pt;">NOTE 4</span></b><span style="font-size: 11pt;">: In this document the state parameter is not used for CSRF protection, but may be used to by the client for application state. In circumstances where clients encode application state in a JWT the length of the state parameter value could be in excess of 1000 characters.<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;">Can any of you find references to Bitbucket issues in which the possibility of adding size limits for FAPI parameters was discussed?<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"> Thanks,<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"> -- Mike<o:p></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Openid-specs-fapi mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:Openid-specs-fapi@lists.openid.net" style="color: rgb(70, 120, 134); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Openid-specs-fapi@lists.openid.net</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.openid.net/mailman/listinfo/openid-specs-fapi" style="color: rgb(70, 120, 134); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.openid.net/mailman/listinfo/openid-specs-fapi</a></div></blockquote></div><br></div></body></html>