Problem description

In the Signed Authentication Requests section of the Authorization Code flow, there is no mention of which typical claims are mandatory, as is already the case in the CIBA specification.

Expected action

To mitigate possible attacks, as we commented in a previous issue, we should make the following claims mandatory: iss, aud, iat, exp and jti.

In addition, we should apply the same maximum request object lifetime policy in both CIBA and Authorization Code flows that we require in the client assertion for authentication.

Additional context