This repository was archived by the owner on Mar 3, 2022. It is now read-only.

Validate issuer from returned discovery document #222

Open

brockallen opened this issue Dec 8, 2016 · 1 comment

Assignees

Labels

Milestone

Contributor

brockallen commented Dec 8, 2016

Check by default, but allow a flag to disable the check

brockallen added the enhancement label

brockallen self-assigned this

brockallen added this to the 2.0.0 milestone

Contributor Author

brockallen commented Dec 13, 2016

Also flags to check/validate:

https from all endpoints if authority also https
all domains in discovery from same origin as authority
require at_hash in id_token
allowed signing algs
require https on authority
require kid (or id_token has kid, mandate that it matches one from keys)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.