Some FAPI2SP clauses about the authorization code flow are in the wrong section
Open
@dpostnikov is already working on this.
Since Jul 10, 2026.
component: FAPI2: Security Profile
migrated-from-bitbucket
priority: major
type: bug
- Dominant language
- HTML
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by josephheenan (Joseph Heenan) on 2025-09-24
I think we discussed this in the context of https://bitbucket.org/openid/fapi/issues/752/request-for-a-tailored-fapi-20-conformance already, but I couldn’t find a dedicated issue:
Some of the clauses in FAPI2SP look like they’re in the wrong place. In particular:
- shall issue authorization codes with a maximum lifetime of 60 seconds;
- if using DPoP, shall support "Authorization Code Binding to DPoP Key" (as required by Section 10.1 of [RFC9449]);
are in the ‘general requirements’ instead of ‘authorization endpoint’ section.
Bitbucket status: open
Bitbucket origin: issue 755
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.