{"action":"created","issue":{"url":"https://api.github.com/repos/ory-am/hydra/issues/42","labels_url":"https://api.github.com/repos/ory-am/hydra/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/ory-am/hydra/issues/42/comments","events_url":"https://api.github.com/repos/ory-am/hydra/issues/42/events","html_url":"https://github.com/ory-am/hydra/issues/42","id":124255652,"number":42,"title":"Security audit based on rfc6819","user":{"login":"arekkas","id":3372410,"avatar_url":"https://avatars.githubusercontent.com/u/3372410?v=3","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-29T19:16:30Z","updated_at":"2015-12-29T19:35:47Z","closed_at":null,"body":"[rfc6819](https://tools.ietf.org/html/rfc6819#section-4.1.1) contains OAuth 2.0 Threat Model and Security Considerations.\r\n\r\n**Review thread model**\r\n* [ ] 4.1 Clients\r\n* [ ] 4.2 Authorization Endpoint\r\n* [ ] 4.3 Token Endpoint\r\n* [ ] 4.4 Obtaining Authorization\r\n* [ ] 4.5 Refreshing an Access Token\r\n\r\n**Review security considerations**\r\n* [ ] 5.1. General\r\n* [ ] 5.2. Authorization Server\r\n* [ ] 5.3. Client App Security\r\n* [ ] 5.4. Resource Servers\r\n* [x] 5.5. A Word on User Interaction and User-Installed Apps "},"comment":{"url":"https://api.github.com/repos/ory-am/hydra/issues/comments/167861293","html_url":"https://github.com/ory-am/hydra/issues/42#issuecomment-167861293","issue_url":"https://api.github.com/repos/ory-am/hydra/issues/42","id":167861293,"user":{"login":"arekkas","id":3372410,"avatar_url":"https://avatars.githubusercontent.com/u/3372410?v=3","gravatar_id":"","url":"https://api.github.com/users/arekkas","html_url":"https://github.com/arekkas","followers_url":"https://api.github.com/users/arekkas/followers","following_url":"https://api.github.com/users/arekkas/following{/other_user}","gists_url":"https://api.github.com/users/arekkas/gists{/gist_id}","starred_url":"https://api.github.com/users/arekkas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arekkas/subscriptions","organizations_url":"https://api.github.com/users/arekkas/orgs","repos_url":"https://api.github.com/users/arekkas/repos","events_url":"https://api.github.com/users/arekkas/events{/privacy}","received_events_url":"https://api.github.com/users/arekkas/received_events","type":"User","site_admin":false},"created_at":"2015-12-29T19:35:46Z","updated_at":"2015-12-29T19:35:46Z","body":"**A note on section 5.4**\r\n\r\nCertificate based HTTP authentication as proposed by section 5.4.2 is out of most resource provider's scope. RESTful APIs are meant to work well with public clients and user agents. Certificate based authentication is thus *unfortunately* not realistic."}}