Gabriel Corona
Gabriel Corona
@ryarmst, this looks good but the first half is somewhat tautological, > Verify that cryptographically secured tokens use a digital signature or MAC […] where, > Cryptographically Secured Token -...
> Although, I believe you are correct that the way 51.3.2 is written it is already handled in 51.2.2. We can remove 51.3.2 then since 51.2.2 handles it. Yes, I...
> Is there any need to say the the nonce must be a unpredictable? I think, this should probably be somewhere and I don't believe it's currently really states **but**...
> Potential [resource](https://ldapwiki.com/wiki/Wiki.jsp?page=Authorization%20Code%20Flow). In complete objectivity, I have to recommend [this resource](https://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagr
The fact that the authorization code is single use indeed prevent against authorization code replay (implemented AS-side). > From the authorization code replay attack point of view, being transaction-specific provides...
See for reference on this topic [4.5.3](https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-24.html#name-countermeasures-4) from the Oauth Security topics draft. And: > **4.3.1 [Authorization Code in Browser History](https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-24.html#name-authorization-code-in-brows)** > > Countermeasures: > > * Authorization code replay...
The first sentence says: > that was initiated by the same client. but then: > and securely bound to the client **and the user agent** in which the transaction was...
With these modifications, that would be: > Verify that the client validates the values (such as authorization code, ID token) sent to the client or received by the client to...
@jmanico, yes this is much better! Two minor grammar fixes (I think): > Verify that the client validates the values (such as the authorization code or ID token) sent to...
OK that would give us: > Verify that the client accepts the values (such as the authorization code or ID token) from the authorization server to ensure they result from...