honeyryder

Pushed Authorization Requests

(available since v1.2.0)

The :oauth_pushed_authorization_request plugin allows for the payload of an OAuth 2.0 authorization request to the authorization server to be “pushed” via a direct request and provides them with a request URI that is used as reference to the data in a subsequent call to the authorization endpoint.

Who is it for

Client applications who want more confidentiality of the parameters for the authorization request, and to authenticate the client before any user interaction happens.

How to enable it

plugin :rodauth do
  enable :oauth_authorization_code_grant, :oauth_pushed_authorization_request
end

Attributes

Pushed authorization requests are bound to a client application, and are stored in its own database table, identified by the oauth_pushed_authorization_requests_table auth method (default: :oauth_pushed_requests). They contain the following attributes:

oauth application id

  • option: oauth_pushed_authorization_requests_oauth_application_id_column
  • default: :oauth_application_id

The client application that generated the PAR.

code

  • option: oauth_pushed_authorization_requests_code_column
  • default: :code

The code by which the pushed authorization request is identified in the authorization request.

Expires In

  • option: oauth_pushed_authorization_requests_expires_in_column
  • default: :expires_in

Timestamp after which the pushed authorization request is no longer valid.

Params

  • option: oauth_pushed_authorization_requests_params_column
  • default: :params

The authorization request params (redirect uri, response mode, etc…) of the pushed authorization request, encoded in the URI-encoded format.

URL

POST /par

The /par endpoint requires client authorization.

Request Parameters

The /par endpoint accepts, per RFC, the same parameters as the authorization request endpoint, with the exception of request_uri.

The also includes receiving the parameter in a request parameter like the one defined for JWT-Secured Authorization Requests.

Response Parameters

When successful, the response serves the following parameters in the JSON response:

  • request_uri: the request uri that shall be used when calling the Authorization request endpoint;
  • expires_in: the number of seconds the request uri above has to be used;

GET /authorize

The Authorization request is then able to accept the request_uri as a query parameter, along with the respective client_id.

Client application options

In order to require pushed authorization requests for a given client, the client application can set the value of the oauth_applications_require_pushed_authorization_requests_column column to true.

Home