Asvs area51 vol1

[elarlang]

This Pull Request relates to issues:

• proposal: add/merge OIDC requirements into OAuth2 paragraph (instead of separate OIDC paragraph) #2039
• Proposal/discussion: OIDC requirement about ID token only being used to prove that the user has been authenticated (edit: a general requirement for allowing only intended usage for tokens) #2005
• V51 OAuth: Add OAuth verifications for token management #2038
• V51 OAuth: Add code and PKCE related verifications #2041

[elarlang]

usual ping @randomstuff @TobiasAhnoff

[tghosth]

Let me know when you want me to review :)

[elarlang]

I prefer those requirements to get in. Those are already improvements what we have now although they are subject to further improvements.

The point and the need is to have clear requirements in the document, not abstract subjects in many parallel issues.

Take it as a development step not a finalizing step.

[tghosth]

So don't wait for a review from Gabriel and Tobias?

[elarlang]

No, I got some feedback already in related issues and we will work on them anyway. Just a first patch to get in.