OAuth 2.0 Pushed Authorization Requests
draft-ietf-oauth-par-01
|
| Document |
Type |
|
Active Internet-Draft (oauth WG)
|
|
Last updated |
|
2020-02-18
|
|
Stream |
|
IETF
|
|
Intended RFC status |
|
(None)
|
|
Formats |
|
plain text
html
xml
pdf
htmlized
bibtex
|
| Stream |
WG state
|
|
WG Document
|
|
Document shepherd |
|
No shepherd assigned
|
| IESG |
IESG state |
|
I-D Exists
|
|
Consensus Boilerplate |
|
Unknown
|
|
Telechat date |
|
|
|
Responsible AD |
|
(None)
|
|
Send notices to |
|
(None)
|
Web Authorization Protocol T. Lodderstedt
Internet-Draft yes.com
Intended status: Standards Track B. Campbell
Expires: 21 August 2020 Ping Identity
N. Sakimura
Nomura Research Institute
D. Tonge
Moneyhub Financial Technology
F. Skokan
Auth0
18 February 2020
OAuth 2.0 Pushed Authorization Requests
draft-ietf-oauth-par-01
Abstract
This document defines the pushed authorization request endpoint,
which allows clients to push the payload of an OAuth 2.0
authorization request to the authorization server via a direct
request and provides them with a request URI that is used as
reference to the data in a subsequent authorization request.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 21 August 2020.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
Lodderstedt, et al. Expires 21 August 2020 [Page 1]
Internet-Draft OAuth PAR February 2020
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Conventions and Terminology . . . . . . . . . . . . . . . 4
2. Pushed Authorization Request Endpoint . . . . . . . . . . . . 4
2.1. Request . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2. Successful Response . . . . . . . . . . . . . . . . . . . 7
2.3. Error Response . . . . . . . . . . . . . . . . . . . . . 8
3. "request" Parameter . . . . . . . . . . . . . . . . . . . . . 9
3.1. Error responses for Request Object . . . . . . . . . . . 10
3.1.1. Authentication Required . . . . . . . . . . . . . . . 10
4. Authorization Request . . . . . . . . . . . . . . . . . . . . 10
5. Authorization Server Metadata . . . . . . . . . . . . . . . . 10
6. Security Considerations . . . . . . . . . . . . . . . . . . . 10
6.1. Request URI Guessing . . . . . . . . . . . . . . . . . . 11
6.2. Open Redirection . . . . . . . . . . . . . . . . . . . . 11
6.3. Request Object Replay . . . . . . . . . . . . . . . . . . 11
6.4. Client Policy Change . . . . . . . . . . . . . . . . . . 11
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 11
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
9. Normative References . . . . . . . . . . . . . . . . . . . . 12
10. Informative References . . . . . . . . . . . . . . . . . . . 12
Appendix A. Document History . . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14
1. Introduction
In OAuth [RFC6749] authorization request parameters are typically
sent as URI query parameters via redirection in the user-agent. This
is simple but also yields challenges:
* There is no cryptographic integrity and authenticity protection,
i.e. the request can be modified on its way through the user-agent
and attackers can impersonate legitimate clients.
* There is no mechanism to ensure confidentiality of the request
parameters.
* Authorization request URLs can become quite large, especially in
Show full document text