FAPI1Adv

Financial-grade API Security Profile (FAPI) 1.0 – Part 2: Advanced

A highly secured OAuth profile that aims to provide specific implementation guidelines for security and interoperability. This document is an officially published standard.

Full text: https://openid.net/specs/openid-financial-api-part-2-1_0.html

Deprecated Features

This document deprecates a number of OAuth features. The OAuch tests related to these deprecated features are:

• Features.IsDeprecatedTlsSupportedTest

Countermeasures

This document introduces a number of security countermeasures for OAuth. The OAuch tests related to these countermeasures are:

• AuthEndpoint.HasValidCertificateTest
• AuthEndpoint.IsHttpsRequiredTest
• AuthEndpoint.IsModernTlsSupportedTest
• TokenEndpoint.HasValidCertificateTest
• TokenEndpoint.IsHttpsRequiredTest
• TokenEndpoint.IsModernTlsSupportedTest
• ApiEndpoint.HasValidCertificateTest
• ApiEndpoint.IsHttpsRequiredTest
• ApiEndpoint.IsModernTlsSupportedTest
• Revocation.IsRevocationEndpointSecureTest
• Revocation.IsModernTlsSupportedTest
• AuthEndpoint.AreStrongCiphersEnabledTest
• TokenEndpoint.AreStrongCiphersEnabledTest
• ApiEndpoint.AreStrongCiphersEnabledTest

Back to the documents overview