Ability for AS to reject requests that have suspicious state/nonce or other params

Originally submitted by dgtonge (Dave Tonge) on 2023-06-21

As issue was raised via email about whether it was acceptable for an AS to reject requests that have suspicious state or nonce values. .e.g with a <script> tag or something similar.

Although the AS shouldn’t be processing such values, the worry was that by not blocking such requests, the AS may be facilitating a XSS attack..

We discussed on the call today that:

1. Nothing is stopping an AS blocking requests that it considers suspicious, e.g. with a <script tag
2. An AS must not wholesale block certain characters, e.g. “<“ - the AS should accept any random state/nonce value that complies with the underlying specs. The conformance suite generated random values for state and nonce.

Please chime in if you have any other view on the above

‌

Bitbucket status: open

Bitbucket origin: issue 610

Start by reading the issue discussion and the referenced Bitbucket issue 610, then review the underlying specifications for state and nonce values. The conformance suite is mentioned as generating random values, so use it to check which values must remain accepted. Done means reaching and recording a clear decision about suspicious-value rejection without wholesale character blocking.