Details
-
Question
-
Resolution: Persuasive
-
FHIR R5 Subscriptions Backport (FHIR)
-
0.1.0 [deprecated]
-
FHIR Infrastructure
-
Safety and Security
-
FHIR-31457 example contradicts Security guidance.
Description
Given this guideline (which I agree with) Subscription.header is a problematic feature.
Existing Wording:
Subscription resources are not intended to be secure storage for secrets (e\.g\., OAuth Client ID or Tokens, etc\.)\. Implementers MAY use their judgement on including limited-use secrets (e\.g\., a token supplied in Subscription\.header to verify that a message is from the desired source)\.
(Comment 25 - imported by: Gino Canessa)
Attachments
Issue Links
- duplicates
-
-
- Published
-
- is voted on by
-
BALLOT-15807 Affirmative - Christopher Schaut : 2021-Jan-FHIR IG R5 SUBSCR 2R4 R1 STU
- Closed
- mentioned in
-
Page Loading...