6. 参考文献 (References)
本节列出 RFC 9207 使用的规范性和资料性参考文献. 规范性引用定义 OAuth 2.0、URI、授权服务器元数据和 JWT 相关基础机制; 资料性引用提供 OpenID Connect、JARM、OAuth 安全最佳实践和形式化安全分析背景. 英文标题、作者、DOI 和 URL 保持原文, 以便与 RFC Editor、IANA 和 OpenID Foundation 记录对应.
从实现角度看, RFC 9207 的引用可分为三组: 第一组是 OAuth 和 URI 基础规范, 用于确定授权响应中 iss 参数的语义边界; 第二组是 JWT、JAR、JARM 和 OpenID Connect 相关文献, 用于说明 issuer 标识在已签名对象和授权响应中的使用方式; 第三组是安全分析和最佳实践文献, 用于解释为什么混淆 issuer 可能导致授权响应注入、客户端混淆或单点登录协议中的二阶漏洞. 因此, 本节不仅是书目列表, 也是理解本文安全动机的索引.
6.1. 规范性参考文献 (Normative References)
[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.
用途: 定义规范性关键词的要求级别.
[RFC3986]
Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>.
用途: 定义 URI 通用语法, 用于解释 issuer 标识符的结构和比较.
[RFC6749]
Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, October 2012, <https://www.rfc-editor.org/info/rfc6749>.
用途: 定义 OAuth 2.0 授权框架, 是本文档的核心协议基础.
[RFC8174]
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.
用途: 说明规范性关键词在大小写使用上的解释规则.
[RFC8414]
Jones, M., Sakimura, N., and J. Bradley, "OAuth 2.0 Authorization Server Metadata", RFC 8414, DOI 10.17487/RFC8414, June 2018, <https://www.rfc-editor.org/info/rfc8414>.
用途: 定义授权服务器元数据, 与本文新增元数据项直接相关.
6.2. 资料性参考文献 (Informative References)
[arXiv.1508.04324]
Mainka, C., Mladenov, V., and J. Schwenk, "On the security of modern Single Sign-On Protocols: Second-Order Vulnerabilities in OpenID Connect", August 2015, <https://arxiv.org/abs/1508.04324>.
说明: 分析 OpenID Connect 中的二阶漏洞, 为 issuer 混淆风险提供研究背景.
[arXiv.1601.01229]
Fett, D., Kuesters, R., and G. Schmitz, "A Comprehensive Formal Security Analysis of OAuth 2.0", DOI 10.1145/2976749.2978385, January 2016, <https://arxiv.org/abs/1601.01229>.
说明: 提供 OAuth 2.0 的形式化安全分析, 有助于理解授权响应完整性要求.
[IANA.OAuth.Parameters]
IANA, "OAuth Parameters", <https://www.iana.org/assignments/oauth-parameters>.
[JARM]
Lodderstedt, T. and B. Campbell, "Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)", October 2018, <https://openid.net/specs/openid-financial-api-jarm.html>.
[OAUTH-SECURITY-TOPICS]
Lodderstedt, T., Bradley, J., Labunets, A., and D. Fett, "OAuth 2.0 Security Best Current Practice", Work in Progress, Internet-Draft, draft-ietf-oauth-security-topics-19, 16 December 2021, <https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-19>.
[OIDC.Core]
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 1", November 2014, <https://openid.net/specs/openid-connect-core-1_0.html>.
[RFC7519]
Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, <https://www.rfc-editor.org/info/rfc7519>.
[RFC7591]
Richer, J., Ed., Jones, M., Bradley, J., Machulak, M., and P. Hunt, "OAuth 2.0 Dynamic Client Registration Protocol", RFC 7591, DOI 10.17487/RFC7591, July 2015, <https://www.rfc-editor.org/info/rfc7591>.
[RFC9101]
Sakimura, N., Bradley, J., and M. Jones, "The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)", RFC 9101, DOI 10.17487/RFC9101, August 2021, <https://www.rfc-editor.org/info/rfc9101>.