JARM is an OAuth response mode that wraps an authorization code in a signed JWT. The signature lets the client verify that the response came from the legitimate authorization server and was not modified. section 10.6
JARM protects the authorization response from this attack sequence:
- A threat actor intercepts the authorization-server response. section 10.6
- The actor modifies the response before relaying it to the user agent. section 10.6
- The client could otherwise be tricked into sending the authorization code to a malicious server, which may exchange it for an access token. section 10.6
Authorization response
After a successful authorization request, the authorization server returns the authorization code inside a signed JWT. The client validates the signature before trusting the response, preserving response integrity. section 10.7
