API Security in Open Banking Context
summary
Open banking needs stronger API controls so FAPI (OAuth2/OIDC profiles) adds specific requirements: private_key_jwt or mutual TLS for client authentication, certificate-bound access tokens plus mandatory token introspection to prevent token reuse, and pushed authorization requests to hide sensitive params. For deviceless flows it prescribes CIBA backend auth with poll or push delivery. The claim is that these concrete protocol additions materially reduce token leakage and impersonation risks in open banking ecosystems.
AI-written summary · about
chapters (5)
- 0:00Start
- 18:00Mutual Tls
- 19:09Token Leakage Scenarios
- 19:34Certified Certificate Bound Access Token
- 20:55Protect the Request Parameters in the Browser in the Url
related talks
24mWhat's new in the OpenID and OAuth specs that drive Banking APIs?
21mMilitary-Grade Security for APIs
24mThe Future of Open Banking: Key Trends & Challenges
32mSecuring Value in API Ecosystems
39mSecure your APIs using OAuth2 and OpenID Connect
37mOpenID Foundation Strategy
17mAPI Security Simplified: Practical Tips & Tools
18mAPI Security Simplified: A 5-Pillar Approach