The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)

Document Information

• RFC Number: 9101
• Title: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
• Authors: N. Sakimura (NAT.Consulting), J. Bradley (Yubico), M. Jones (Microsoft)
• Date: August 2021
• Category: Standards Track

Abstract

The authorization request in OAuth 2.0 described in RFC 6749 utilizes query parameter serialization, which means that authorization request parameters are encoded in the URI of the request and sent through user agents such as web browsers. While it is easy to implement, it means that a) the communication through the user agents is not integrity protected and thus, the parameters can be tainted, b) the source of the communication is not authenticated, and c) the communication through the user agents can be monitored. Because of these weaknesses, several attacks to the protocol have now been put forward.

This document introduces the ability to send request parameters in a JSON Web Token (JWT) instead, which allows the request to be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained. The request can be sent by value or by reference.

Status of This Memo

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9101.

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Contents

• 1. Introduction
  • 1.1. Requirements Language
• 2. Terminology
  • 2.1. Request Object
  • 2.2. Request Object URI
• 3. Symbols and Abbreviated Terms
• 4. Request Object
• 5. Authorization Request
  • 5.1. Passing a Request Object by Value
  • 5.2. Passing a Request Object by Reference
    • 5.2.1. URI Referencing the Request Object
    • 5.2.2. Request Using the "request_uri" Request Parameter
    • 5.2.3. Authorization Server Fetches Request Object
• 6. Validating JWT-Based Requests
  • 6.1. JWE Encrypted Request Object
  • 6.2. JWS-Signed Request Object
  • 6.3. Request Parameter Assembly and Validation
• 7. Authorization Server Response
• 8. TLS Requirements
• 9. IANA Considerations
  • 9.1. OAuth Parameters Registration
  • 9.2. OAuth Authorization Server Metadata Registry
  • 9.3. OAuth Dynamic Client Registration Metadata Registry
  • 9.4. Media Type Registration
    • 9.4.1. Registry Contents
• 10. Security Considerations
  • 10.1. Choice of Algorithms
  • 10.2. Request Source Authentication
  • 10.3. Explicit Endpoints
  • 10.4. Risks Associated with request_uri
    • 10.4.1. DDoS Attack on the Authorization Server
    • 10.4.2. Request URI Rewrite
  • 10.5. Downgrade Attack
  • 10.6. TLS Security Considerations
  • 10.7. Parameter Mismatches
  • 10.8. Cross-JWT Confusion
• 11. Privacy Considerations
  • 11.1. Collection Limitation
  • 11.2. Disclosure Limitation
    • 11.2.1. Request Disclosure
    • 11.2.2. Tracking Using Request Object URI
• 12. References
  • 12.1. Normative References
  • 12.2. Informative References
• Acknowledgements
• Authors' Addresses