See the section on implementing security in the Identity Server for information and instructions on configuring security specific to the WSO2 Identity Server. It includes the following sections: - Saving Access Tokens in Separate Tables
- Timestamp in WS-Security to Mitigate Replay Attacks
- Mitigating Authorization Code Interception Attacks
- Mitigating Cross Site Request Forgery (CSRF) Attacks
- Configuring Callback URL Regular Expressions
Certificate validation for REST APIs : When configuring intermediate certificate validation for REST APIs, it is recommended to add the ExemptContext parameter and leave it empty. This is because authentication might fail for the exempted contexts. For more information, see the instructions in the 3rd point on Authenticating and Authorizing REST APIs.
|