Private key jwt aud restrictions

Open

#714 opened on Jul 2, 2026 6 comments 0 reactions 1 assignee View on GitHub

@davidgtonge is already working on this.

Since Jul 11, 2026.

Assessment

This issue has not been assessed yet.

component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug

Originally submitted by dgtonge (Dave Tonge) on 2024-12-04

Bring the same language from fapi2 to fapi1 errata

Bitbucket status: new

Bitbucket origin: issue 726

No contributing guide indexed for this repository

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Abstract should not be there for FAPI1 Open

component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

openid/fapi#834 · 2 comments · Opened Jul 2, 2026
Yet other editorial fixes for ISO adoption Open

migrated-from-bitbucket priority: trivial type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

openid/fapi#833 · 1 comment · Opened Jul 2, 2026
OWASP ASVS 5.0 section 10.4.8 requires strict refresh token expiry, which conflicts with FAPI 2.0 SP 5.3.2.1-9 Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

openid/fapi#864 · 2 comments · Opened Aug 27, 2026
detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance tests Open

component: Certification component: FAPI2: Advanced Authorization

Difficulty 5/5 Over a week Newbie friendliness 35/100

openid/fapi#863 · 1 comment · 1 reaction · 1 assignee · Opened Aug 26, 2026
meaning of FAPI2 requirements around publishing discovery data Open

component: Certification component: FAPI2: Security Profile

Difficulty 4/5 3-5 days Newbie friendliness 35/100

openid/fapi#862 · 1 comment · Opened Aug 26, 2026