PKCE & Nonce Security Considerations
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by dgtonge (Dave Tonge) on 2020-05-20
Daniel Fett has posted a very useful analysis of nonce and PKCE:
https://danielfett.de/2020/05/16/pkce-vs-nonce-equivalent-or-not/
We should consider whether to add additional security considerations around this in FAPI and if so, whether they need to be in part 1 or part 2.
There was discussion on the call today of potentially requiring servers to reject token requests with a code_verifier where none was expected.
There was also discussion about whether in Part 2 we are protected against such attacks due to the integrity protection from JARM or ID Tokens.
We agreed to open this issue for further discussion.
Bitbucket status: open
Bitbucket origin: issue 293
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Daniel Fett’s linked analysis, then review the current FAPI Part 1 and Part 2 security requirements and the issue’s discussion. Determine whether additional nonce or PKCE considerations are needed, where they belong, and how unexpected code_verifier values should be handled. Done means the requirements and placement are agreed.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100