Remove note on IdP to validate nonce (w3c-fedid#582) (w3c-fedid#583)

Co-authored-by: Kai Lehmann <[email protected]>
mattdanielbrown · May 15, 2024 · 10794f7 · 10794f7
1 parent 82db3af
commit 10794f7
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/spec/index.bs b/spec/index.bs
@@ -2045,8 +2045,6 @@ the <a http-header>Origin</a> header value is represented by the
 [=IDP=]-specific, the [=user agent=] cannot perform this check.
 </div>
 
-Note: An [=IDP=] should validate the nonce, if present, to prevent CSRF-style attacks.
-
 The response body must be a JSON object that can be [=converted to an IDL value|converted=] to an {{IdentityProviderToken}} without an exception.
 
 Every {{IdentityProviderToken}} is expected to have members with the following semantics: