Skip to main content

7.1. Request URI Guessing

7.1. Request URI Guessing​

An attacker could attempt to guess and replay a valid request URI value and try to impersonate the respective client. The authorization server MUST account for the considerations given in JAR [RFC9101], Section 10.2, clause (d) on request URI entropy.

Last updated on