In addition, the following list of attack vectors and remedies are also considered. 15.1. Request Disclosure If appropriate measures are not taken, a request might be disclosed to an attacker, posing security and privacy threats. In addition to what is stated in Section 5.1.1 of , this standard provides a way to provide the confidentiality of the request end to end through the use of request or request_uri parameters, where the content of the is an encrypted JWT with the appropriate key request and cipher. This protects even against a compromised User-Agent in the case of indirect request. 15.2. Server Masquerading A malicious Server might masquerade as the legitimate server using various means. To detect such an attack, the Client needs to authenticate the server. In addition to what is stated in Section 5.1.2 of , this standard provides a way to authenticate the Server through either the use of Signed or Encrypted JWTs with an appropriate key and cipher. 15.3. Token Manufacture/Modification An Attacker might generate a bogus token or modify the token content (such as the authentication or attribute statements) of an existing parseable token, causing the RP to grant inappropriate access to the Client. For example, an Attacker might modify the parseable token to extend the validity period; a Client might modify the parseable token to have access to information that they should not be able to view.
In addition, the following list of attack vectors and remedies are also considered. 15.1. Request Disclosure If appropriate measures are not taken, a request might be disclosed to an attacker, posing security and privacy threats. In addition to what is stated in Section 5.1.1 of , this standard provides a way to provide the confidentiality of the request end to end through the use of request or request_uri parameters, where the content of the request is an encrypted JWT with the appropriate key and cipher. This protects even against a compromised User-Agent in the case of indirect request. 15.2. Server Masquerading A malicious Server might masquerade as the legitimate server using various means. To detect such an attack, the Client needs to authenticate the server. In addition to what is stated in Section 5.1.2 of , this standard provides a way to authenticate the Server through either the use of Signed or Encrypted JWTs with an appropriate key and cipher. 15.3. Token Manufacture/Modification An Attacker might generate a bogus token or modify the token content (such as the authentication or attribute statements) of an existing parseable token, causing the RP to grant inappropriate access to the Client. For example, an Attacker might modify the parseable token to extend the validity period; a Client might modify the parseable token to have access to information that they should not be able to view.