Loading...

XML

Word

Printable

JSON

Specification:

US UDAP Security (FHIR)
Raised in Version:

1.0.0
Work Group:

Security
Related Page(s):

Registration
Grouping:
- STU2
Resolution Description:

Hide

Include in STU2, as new material. Required support for S256 hashing algorithm. Proposal is to add support for PKCE for server (discuss client), belongs in auth and token requests (4.1 and 4.2). Also in tiered OAuth (6.2). Add code challenge and code responses. Choice: 1) server must support it and clients should use or 2) servers must support AND clients must use (in token request). Group poll, preference for Option 1.

Consider how this requirement impacts state. Intention is to align/build upon OAuth.

Show
Include in STU2, as new material. Required support for S256 hashing algorithm. Proposal is to add support for PKCE for server (discuss client), belongs in auth and token requests (4.1 and 4.2). Also in tiered OAuth (6.2). Add code challenge and code responses. Choice: 1) server must support it and clients should use or 2) servers must support AND clients must use (in token request). Group poll, preference for Option 1. Consider how this requirement impacts state. Intention is to align/build upon OAuth.
Resolution Vote:
Dave Pyke / Joe Lamy : 14 - 0 - 0
Change Category:
Enhancement
Change Impact:
Compatible, substantive

PKSE is essential to avoid security incidence. The IG should have guidance and requirements for it's use as part of the flows.