A JWT-secured authorization request (JAR) protects OAuth authorization parameters by wrapping them in a signed JWT called a request object. The signature helps the authorization server detect tampering and verify the client’s identity. section 10.5 section 10.7
Ordinary authorization URLs expose values such as client_id and redirect_uri to network observers and access logs. Attackers may alter the redirect URI, steal authorization codes, forge requests for CSRF attacks, or redirect users to malicious sites. section 10.4 section 10.5
A JAR-based authorization flow can use these forms:
- The client places the signed JWT directly in the authorization request’s request parameter. section 10.5
- The client stores the request object and sends a request_uri that identifies it by reference. section 10.5
- With pushed authorization requests (PAR), the authenticated client sends the request object to the authorization server and receives a unique request URI for the user-agent redirect. section 10.4 section 10.5
Request object payload
A request object can carry iss, aud, response_type, client_id, redirect_uri, scope, state, nonce, and max_age. The client signs this payload before sending it directly or pushing it through PAR. section 10.5
Figure 10.7 Using PAR, the client exchanges the authorization request parameters with the authorization server for a unique request URI. Then the client uses the request URI to form the authorization request URL and redirects the user agent to it.
Follow the PAR exchange from the signed authorization request to the unique request URI used in the browser redirect. section 10.4
