[JIRA] (JOIDC-113) Stricter-then-standard parameter checking

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-113 ( https://shibboleth.atlassian.net/browse/JOIDC-113?atlOrigin=eyJpIjoiZjgwNTU3NGViZmYyNDMzMTlkNTdlZmZjYjA3YzdiMTciLCJwIjoiaiJ9 )

Re: Stricter-then-standard parameter checking ( https://shibboleth.atlassian.net/browse/JOIDC-113?atlOrigin=eyJpIjoiZjgwNTU3NGViZmYyNDMzMTlkNTdlZmZjYjA3YzdiMTciLCJwIjoiaiJ9 )

I think we should strictly follow the spec here, not add other rules that simply aren’t part of it. I assume the behavior here is just that it overrides the query parameters, as I believe that’s how it’s specified (request object takes precedence).

It’s actually wrong to require scope be identical. We require it, by default, to be a subset of what was already validated on the front-channel though, but we don’t (and should not) require that it be identical, the spec allows narrowing on subsequent token requests.

If you want to implement other checks, I’d probably just do it in an inbound interceptor.

( https://shibboleth.atlassian.net/browse/JOIDC-113#add-comment?atlOrigin=eyJpIjoiZjgwNTU3NGViZmYyNDMzMTlkNTdlZmZjYjA3YzdiMTciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-113#add-comment?atlOrigin=eyJpIjoiZjgwNTU3NGViZmYyNDMzMTlkNTdlZmZjYjA3YzdiMTciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:f4460c0 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/6b5e0095/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-df09b165-6faa-49e7-8f9a-ed4fd2e28648
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/6b5e0095/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-8b28d765-208a-420b-9d22-b901f74fcc9d
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/6b5e0095/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-e719a394-1fd3-4eec-a678-e85f42e89074
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/6b5e0095/attachment-0005.png>