Skip to main content

Security

Required​

  • Use HTTPS only.
  • Do not log password/PIN/token/refresh_token/auth_data.
  • Mask/redact sensitive data when handling incidents.
  • Store secrets in a secret store or secure configuration.
  • Do not put credentials in the query string.

Signing data​

Certificate, credentialID, auth_data, and PIN information must be handled as sensitive data.