recommendation to the use of explicit typing for ID Tokens
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 3
- Forks
- 3
- Avg merge
- 20h 14m
- Merged PRs (30d)
- 1
Description
Originally submitted by Andrii Deinega (Andrii Deinega) on 2024-07-29
The OpenID Connect Core 1.0 incorporating (errata set 2) neither defines a value for the “typ” header parameter nor requires the use of it (see section the explicit typing in RFC 8725 JSON Web Token Best Current Practices).
The suggestion is at least to recommend using it for 1.0.
Newer versions of the spec can require it, the same holds true for Logout Tokens
It is RECOMMENDED that Logout Tokens be explicitly typed. This is accomplished by including a typ (type) Header Parameter with a value of logout+jwt in the Logout Token.
and for JWT assertions that are used as client credentials (client_secret_jwt and private_key_jwt).
Bitbucket status: open
Bitbucket origin: issue 2162
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the OpenID Connect Core 1.0 text with errata set 2 and RFC 8725's section on explicit JWT typing. Review the mentioned Logout Token and client-credential JWT cases, then identify the affected specification wording. Done means the scope and recommendation are agreed and the relevant specifications consistently reflect it.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, documentation, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100