The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)
draft-ietf-oauth-jwsreq-14
- Versions
- 00
- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
The information below is for an old version of the document | |||
---|---|---|---|
Document | Type | Active Internet-Draft (oauth WG) | |
Authors | Nat Sakimura , John Bradley | ||
Last updated | 2017-07-20 | ||
Replaces | draft-sakimura-oauth-requrl | ||
Stream | IETF | ||
Intended RFC status | Proposed Standard | ||
Formats | pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Hannes Tschofenig | ||
Shepherd write-up | Show (last changed 2016-10-10) | ||
IESG | IESG state | IESG Evaluation::AD Followup | |
Consensus Boilerplate | Yes | ||
Telechat date |
Has enough positions to pass. |
||
Responsible AD | Eric Rescorla | ||
Send notices to | (None) | ||
IANA | IANA review state | Version Changed - Review Needed |
OAuth Working Group N. Sakimura Internet-Draft Nomura Research Institute Intended status: Standards Track J. Bradley Expires: January 22, 2018 Yubico July 21, 2017 The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR) draft-ietf-oauth-jwsreq-14 Abstract The authorization request in OAuth 2.0 described in RFC 6749 utilizes query parameter serialization, which means that Authorization Request parameters are encoded in the URI of the request and sent through user agents such as web browsers. While it is easy to implement, it means that (a) the communication through the user agents are not integrity protected and thus the parameters can be tainted, and (b) the source of the communication is not authenticated. Because of these weaknesses, several attacks to the protocol have now been put forward. This document introduces the ability to send request parameters in a JSON Web Token (JWT) instead, which allows the request to be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication and confidentiality property of the Authorization Request is attained. The request can be sent by value or by reference. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 22, 2018. Sakimura & Bradley Expires January 22, 2018 [Page 1] Internet-Draft OAuth JAR July 2017 Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 5 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.1. Request Object . . . . . . . . . . . . . . . . . . . . . 6 2.2. Request Object URI . . . . . . . . . . . . . . . . . . . 6 3. Symbols and abbreviated terms . . . . . . . . . . . . . . . . 6 4. Request Object . . . . . . . . . . . . . . . . . . . . . . . 6 5. Authorization Request . . . . . . . . . . . . . . . . . . . . 8 5.1. Passing a Request Object by Value . . . . . . . . . . . . 9 5.2. Passing a Request Object by Reference . . . . . . . . . . 10 5.2.1. URI Referencing the Request Object . . . . . . . . . 11 5.2.2. Request using the "request_uri" Request Parameter . . 12 5.2.3. Authorization Server Fetches Request Object . . . . . 12 6. Validating JWT-Based Requests . . . . . . . . . . . . . . . . 13 6.1. Encrypted Request Object . . . . . . . . . . . . . . . . 13 6.2. JWS Signed Request Object . . . . . . . . . . . . . . . . 13 6.3. Request Parameter Assembly and Validation . . . . . . . . 14 7. Authorization Server Response . . . . . . . . . . . . . . . . 14 8. TLS Requirements . . . . . . . . . . . . . . . . . . . . . . 14 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . 15 10. Security Considerations . . . . . . . . . . . . . . . . . . . 15 10.1. Choice of Algorithms . . . . . . . . . . . . . . . . . . 15 10.2. Request Source Authentication . . . . . . . . . . . . . 15 10.3. Explicit Endpoints . . . . . . . . . . . . . . . . . . . 16 10.4. Risks Associated with request_uri . . . . . . . . . . . 17 10.4.1. DDoS Attack on the Authorization Server . . . . . . 17Show full document text