open-banking-gateway icon indicating copy to clipboard operation
open-banking-gateway copied to clipboard

Published 20 hours ago • verified publisher icon adorsys

Code2Token (confirmConsent) should use secret code to activate consent

Open valb3r opened this issue 5 years ago • 0 comments
trafficstars

Currently, confirmConsent uses authorization-id that is shared with the client device to activate consent. We need to heighten the security so that one needs a secret code additionally like in Ouath2 to activate the consent. This code should be returned on 202 listAccounts/listTransactions. This means that confirmConsent should accept both auth-id and secret-code to activate consent and the secret code is returned to FinTech on initiating call (i.e. listAccounts)

valb3r avatar Apr 26 '20 06:04 valb3r