8. 参考文献
本节列出 JWT Profile for OAuth 2.0 Access Tokens 使用的规范性和资料性文献. 规范性引用定义 OpenID Connect、MIME 媒体类型、OAuth 2.0、JWS、JWA、JWT、SCIM Core Schema、授权服务器元数据、Token Exchange、Resource Indicators 和 JWT 最佳实践. 资料性引用提供 IANA 媒体类型注册表、OAuth 安全最佳实践、Bearer Token、JWT Profile for OAuth 2.0 Client Authentication、Token Introspection 等背景.
这些文献共同限定了 JWT 访问令牌的签名、媒体类型、claim 语义、受众选择、授权范围和安全处理方式. 英文标题、作者、URL 和 RFC 编号保持原文, 以便实现者准确定位原始规范.
阅读本节时可以按功能划分: OpenID Connect 文献用于理解 auth_time、acr、amr 等认证相关 claim; JOSE/JWT 文献用于理解签名、算法、头部和 claim 注册; OAuth 文献用于理解授权服务器、资源服务器、token exchange、resource indicators 和 introspection; SCIM 文献用于理解 roles、groups 和 entitlements 等授权属性. 这些引用共同防止 JWT access token 与 ID Token、Bearer Token 或私有令牌格式混淆.
8.1. 规范性参考文献
规范性参考文献是实现本配置文件时必须遵循的协议和注册依据. 其中 JWT 最佳实践尤其重要, 因为它直接关系到显式类型、受众隔离和跨 JWT 混淆防护.
[OpenID.Core]
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 1", November 2014, ````https://openid.net/specs/openid-connect-core-1_0.html\````.
[OpenID.Discovery]
Sakimura, N., Bradley, J., Jones, M., and E. Jay, "OpenID Connect Discovery 1.0 incorporating errata set 1", November 2014, ````https://openid.net/specs/openid-connect-discovery-1_0.html\````.
[RFC2046]
Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, DOI 10.17487/RFC2046, November 1996, ````https://www.rfc-editor.org/info/rfc2046\````.
[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, ````https://www.rfc-editor.org/info/rfc2119\````.
[RFC6749]
Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, October 2012, ````https://www.rfc-editor.org/info/rfc6749\````.
[RFC6838]
Freed, N., Klensin, J., and T. Hansen, "Media Type Specifications and Registration Procedures", BCP 13, RFC 6838, DOI 10.17487/RFC6838, January 2013, ````https://www.rfc-editor.org/info/rfc6838\````.
[RFC7515]
Jones, M., Bradley, J., and N. Sakimura, "JSON Web Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May 2015, ````https://www.rfc-editor.org/info/rfc7515\````.
[RFC7518]
Jones, M., "JSON Web Algorithms (JWA)", RFC 7518, DOI 10.17487/RFC7518, May 2015, ````https://www.rfc-editor.org/info/rfc7518\````.
[RFC7519]
Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, ````https://www.rfc-editor.org/info/rfc7519\````.
[RFC7643]
Hunt, P., Ed., Grizzle, K., Wahlstroem, E., and C. Mortimore, "System for Cross-domain Identity Management: Core Schema", RFC 7643, DOI 10.17487/RFC7643, September 2015, ````https://www.rfc-editor.org/info/rfc7643\````.
[RFC8174]
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, ````https://www.rfc-editor.org/info/rfc8174\````.
[RFC8414]
Jones, M., Sakimura, N., and J. Bradley, "OAuth 2.0 Authorization Server Metadata", RFC 8414, DOI 10.17487/RFC8414, June 2018, ````https://www.rfc-editor.org/info/rfc8414\````.
[RFC8693]
Jones, M., Nadalin, A., Campbell, B., Ed., Bradley, J., and C. Mortimore, "OAuth 2.0 Token Exchange", RFC 8693, DOI 10.17487/RFC8693, January 2020, ````https://www.rfc-editor.org/info/rfc8693\````.
[RFC8707]
Campbell, B., Bradley, J., and H. Tschofenig, "Resource Indicators for OAuth 2.0", RFC 8707, DOI 10.17487/RFC8707, February 2020, ````https://www.rfc-editor.org/info/rfc8707\````.
[RFC8725]
Sheffer, Y., Hardt, D., and M. Jones, "JSON Web Token Best Current Practices", BCP 225, RFC 8725, DOI 10.17487/RFC8725, February 2020, ````https://www.rfc-editor.org/info/rfc8725\````.
8.2. 资料性参考文献
资料性参考文献提供安全实践和相邻 OAuth 机制的背景, 有助于实现者判断何时应使用 token introspection、Bearer Token 规则或客户端认证相关 JWT profile.
本配置文件的实现风险通常来自“看起来都是 JWT”的对象混用. 因此, 读者应特别关注 [RFC8725] 的 JWT 最佳实践、[RFC7515] 和 [RFC7518] 对签名与算法的约束、[RFC8707] 对资源指示符的定义, 以及 [RFC7662] 对 introspection 的补充作用. 这些文献共同帮助资源服务器判断令牌是否面向自己、是否由可信 issuer 签发、是否携带适合该资源的授权范围.
[IANA.MediaTypes]
IANA, "Media Types", ````https://www.iana.org/assignments/media-types/\````.
[OAuth2.Security.BestPractices]
Lodderstedt, T., Bradley, J., Labunets, A., and D. Fett, "OAuth 2.0 Security Best Current Practice", Work in Progress, Internet-Draft, draft-ietf-oauth-security-topics-18, 13 April 2021, ````https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-18\````.
[RFC6750]
Jones, M. and D. Hardt, "The OAuth 2.0 Authorization Framework: Bearer Token Usage", RFC 6750, DOI 10.17487/RFC6750, October 2012, ````https://www.rfc-editor.org/info/rfc6750\````.
[RFC7523]
Jones, M., Campbell, B., and C. Mortimore, "JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants", RFC 7523, DOI 10.17487/RFC7523, May 2015, ````https://www.rfc-editor.org/info/rfc7523\````.
[RFC7662]
Richer, J., Ed., "OAuth 2.0 Token Introspection", RFC 7662, DOI 10.17487/RFC7662, October 2015, ````https://www.rfc-editor.org/info/rfc7662\````.