Is nbf a mandatory requirement for request object in FAPI 2 message signing?
@dpostnikov 已经在做这个了。
开始于 2026年7月11日。
评估
这个 Issue 还没有评估数据。
描述
Originally submitted by Dima Postnikov (Dima Postnikov) on 2025-08-06
Current text says:
Clients implementing FAPI2 authorization request signing:
…
shall send a
nbfclaim in the request object…
I understand that there are circumstances where it’s useful to have but is it required for every request?
Side question. Should this text from FAPI 2 security profile be in FAPI 2 message signing instead?
- to accommodate clock offsets, shall accept JWTs with an
iatornbftimestamp between 0 and 10 seconds in the future but shall reject JWTs with aniatornbftimestamp greater than 60 seconds in the future. See Note 3 for further details and rationale; andNOTE 3: Clock skew is a cause of many interoperability issues. Even a few hundred milliseconds of clock skew can cause JWTs to be rejected for being "issued in the future". The DPoP specification [RFC9449] suggests that JWTs are accepted in the reasonably near future (on the order of seconds or minutes). This document goes further by requiring authorization servers to accept JWTs that have timestamps up to 10 seconds in the future. 10 seconds was chosen as a value that does not affect security while greatly increasing interoperability. Implementers are free to accept JWTs with a timestamp of up to 60 seconds in the future. Some ecosystems have found that the value of 30 seconds is needed to fully eliminate clock skew issues. To prevent implementations switching off
iatandnbfchecks completely this document imposes a maximum timestamp in the future of 60 seconds.
Bitbucket status: open
Bitbucket origin: issue 753
- 主要语言
- HTML
- 星标
- 5
- 派生
- 3
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
openid/fapi 的其他 Issue
-
component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug
难度 2/5 1-3 小时 新手友好度 62/100
-
migrated-from-bitbucket priority: trivial type: bug
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 5/5 一周以上 新手友好度 30/100
-
component: Implementation & Deployment Advice
难度 2/5 1-3 小时 新手友好度 55/100
-
难度 5/5 一周以上 新手友好度 35/100