{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1429","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1429/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1429/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1429/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1429","id":83660278,"number":1429,"title":"Chapet 16.  Security Considerations","user":{"login":"rdzidziguri","id":6897869,"avatar_url":"https://avatars.githubusercontent.com/u/6897869?v=3","gravatar_id":"","url":"https://api.github.com/users/rdzidziguri","html_url":"https://github.com/rdzidziguri","followers_url":"https://api.github.com/users/rdzidziguri/followers","following_url":"https://api.github.com/users/rdzidziguri/following{/other_user}","gists_url":"https://api.github.com/users/rdzidziguri/gists{/gist_id}","starred_url":"https://api.github.com/users/rdzidziguri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rdzidziguri/subscriptions","organizations_url":"https://api.github.com/users/rdzidziguri/orgs","repos_url":"https://api.github.com/users/rdzidziguri/repos","events_url":"https://api.github.com/users/rdzidziguri/events{/privacy}","received_events_url":"https://api.github.com/users/rdzidziguri/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-06-01T19:41:14Z","updated_at":"2015-06-10T08:49:57Z","closed_at":null,"body":"If one reads specs of OpenID Connect there is a section related to security considerations which every open or Identity System should understand so my general question is about encryption of requests and other security considerations which might apply to IdSer providers. \r\n\r\n**16.5.  Server Response Disclosure**\r\n> The server response might contain authentication data and Claims that include sensitive Client information. Disclosure of the response contents can make the Client vulnerable to other types of attacks. \r\n\r\nas a solution for this risk specs suggests to either use code response type or.\r\n\r\n> For other Response Types, the signed response can be encrypted with the Client's public key or a shared secret as an encrypted JWT with an appropriate key and cipher. \r\n\r\n**QUESTION 1:**\r\nhow this second functionality is handled by IdentityServer3?\r\n\r\n **16.21.  Need for Encrypted Requests**\r\nI had an question about this few days ago and we had a very interesting discussion about this with one of the community members here so here it is just another risk OpenID Connect identifies.\r\n\r\n> In some situations, knowing the contents of an OpenID Connect request can, in and of itself, reveal sensitive information about the End-User. For instance, knowing that the Client is requesting a particular Claim or that it is requesting that a particular authentication method be used can reveal sensitive information about the End-User. OpenID Connect enables requests to be encrypted to the OpenID Provider to prevent such potentially sensitive information from being revealed. \r\n\r\n**QUESTION 2:**\r\nhow this is achieved within Identity Server 3 are there any examples of handling encrypted requests or does with apply to implicit flow (passing request parameters to query string as an encrypted value)?\r\n\r\n I think this is all very important to understand those bits of specs and the way they are implemented in different Identity Providers. as IdentityServer3 is officially certified by OpenID Connect I do not say there is something wrong with it I love this project and hope to find time to even contribute but for now those are questions which I hope to get answers from @brockallen  and @leastprivilege "},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/110658625","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1429#issuecomment-110658625","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1429","id":110658625,"user":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"created_at":"2015-06-10T08:49:57Z","updated_at":"2015-06-10T08:49:57Z","body":"You need to switch to a JWT library that supports encryption according to the JOSE spec.\r\n\r\nMaybe try this one: https://github.com/dvsekhvalnov/jose-jwt\r\n\r\nWould be interested in the outcome."}}