OAuth security BCP addition
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by josephheenan (Joseph Heenan) on 2026-03-16
Note that there's an update to the OAuth security in progress:
https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics-update/
We should probably address the document and each mentioned attack in some way.
1 attack is the private_key_jwt aud issue that's already addressed. I'm not sure about the others.
Bitbucket status: new
Bitbucket origin: issue 855
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked OAuth Security Topics Update draft and compare each mentioned attack with the current FAPI document. Check the existing private_key_jwt aud treatment, which the issue says is already addressed. Done means every relevant attack has a decided treatment and the document reflects it.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100