ClientSecurityProfile Enum
A named bundle of security controls a client is held to. Selecting a profile forces the whole bundle on the client at once and prevents an individual toggle from silently weakening it, which is what makes a client conformant with one setting instead of several hand-tuned flags.
public enum ClientSecurityProfileFields
None 0
No bundled profile: nothing is demanded beyond the client's individual metadata flags. As a
client's explicit value it therefore adds nothing to whatever the deployment already demands,
and takes nothing away; as the server-wide
DefaultSecurityProfile it demands nothing of anyone. A
client that states no preference leaves its profile unset (null) rather than selecting
this.
Fapi2 1
The FAPI 2.0 Security Profile. Forces PKCE restricted to S256, Pushed Authorization
Requests, sender-constrained (DPoP) tokens, and the authorization-code response type only,
regardless of the client's individual toggles. This is the prerequisite for running the
OpenID Foundation FAPI 2.0 conformance suite against the client.
Remarks
Deliberately a closed enum rather than a set of independent booleans: the value set is fixed by the library (a host cannot invent a profile), and a single discriminator is what the effective-policy lookup and the fail-loud self-consistency check both key on. New profiles (message-signing, HAIP, ...) extend this enum; the control mapping lives in SecurityProfileRequirements so adding one touches a single place.