Resolve question of entropy in client-generated state param at authorization

[jmandel]

Reported by Joseph Lorenzo Hall via http://wiki.siframework.org/BlueButtonPlus+Pull+API+Documentation+Consensus

blue-button-plus-pull/index.html

Line 1492 in eb86bcf

request forgery <span class=

leaves an open question

[jmandel]

@jricher I'd suggest we say "The state parameter SHOULD be used, with sufficient entropy for preventing cross-site request forgery." If you want to make a specific entropy recommendation (or requirements) in bits, let me know what you have in mind.

[jricher]

I'm fine with that -- what we ended up doing in OpenID Connect's latest draft is to say "sufficient entropy" and then list examples of "bad entropy", like a static value, increasing sequence of integers, and things like that.