A request URI is a short-lived identifier for a registered authorization request object. The client places it in the authorization request’s request_uri parameter, and the authorization server retrieves the object through that URI to verify the request. section 10.5
A reference-based authorization request follows this sequence:
- The client stores the signed request object and issues a URI identifying it. section 10.5
- The URI remains valid for less than a minute and permits one-time access. section 10.5
- The authorization server retrieves the object through a GET request and verifies its legitimacy. section 10.5
Authorization request by reference
Instead of placing the complete signed request object in the request parameter, the client sends an authorization request containing client_id and request_uri. The request_uri identifies the stored object for the authorization server.
Figure 10.13 In a PAR, the client issues the authorization request JWT and pushes it to the authorization server in exchange for a request URI, which the client inserts into the authorization request’s request_uri parameter.
Shows how pushed authorization requests return a request URI that the client inserts into the authorization request. section 10.5
