nasso.dev / core
forked from tangled.org/core
Star
Fork 0
Watch

appview/oauth: verify "iss" parameter in auth response master

From https://datatracker.ietf.org/doc/html/rfc9207#section-2.4 : "Clients MUST [...] compare the result to the issuer identifier of the authorization server where the authorization request was sent to. [...] If the value does not match the expected issuer identifier, clients MUST reject the authorization response and MUST NOT proceed with the authorization grant." Signed-off-by: Mike P <fentiger@mythik.co.uk>

Author Mike P Committer Anirudh Oppiliappan Date Commit 801c1427 Parent 45efee41
+6
1 changed file