From d0e801718ebbc290f2f9992c9c21c4ebd997b017 Mon Sep 17 00:00:00 2001 From: Elar Lang Date: Thu, 17 Oct 2024 16:10:15 +0300 Subject: [PATCH] #2003 - oidc client - metadata confusion --- 5.0/en/0x51-V51-OAuth2.md | 1 + 1 file changed, 1 insertion(+) diff --git a/5.0/en/0x51-V51-OAuth2.md b/5.0/en/0x51-V51-OAuth2.md index 91812f5797..70ad35d121 100644 --- a/5.0/en/0x51-V51-OAuth2.md +++ b/5.0/en/0x51-V51-OAuth2.md @@ -57,6 +57,7 @@ There are various different personas in the OAuth process, described in more det | :---: | :--- | :---: | :---: | :---: | | **51.5.1** | [ADDED] Verify that the Client (as the Relying Party) mitigates ID Token replay attacks. For example, by ensuring that the nonce claim in the ID Token matches the nonce value sent in the Authentication Request to the OpenID Provider (in OAuth2 refereed to as the Authorization request sent to the Authorization Server). | ✓ | ✓ | ✓ | | **51.5.2** | [ADDED] Verify that the Client uniquely identifies the user from ID token claims, usually the 'sub' claim, which cannot be reassigned to other users (for the scope of an identity provider). | ✓ | ✓ | ✓ | +| **51.5.3** | [ADDED] Verify that the client rejects attempts by a malicious authorization server to impersonate another authorization server through authorization server metadata. The client must reject authorization server metadata if the issuer URL in the authorization server metadata does not exactly match the pre-configured issuer URL expected by client. | ✓ | ✓ | ✓ | ## V51.5 OIDC OpenID Provider