API Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 9101
[ACTIVE]

The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)

Metadata

Publisher
IETF
Doc Type
Standard
Pages
25
Abstract
The authorization request in OAuth 2.0 described in RFC 6749 utilizes query parameter serialization, which means that authorization request parameters are encoded in the URI of the request and sent through user agents such as web browsers. While it is easy to implement, it means that a) the communication through the user agents is not integrity protected and thus, the parameters can be tainted, b) the source of the communication is not authenticated, and c) the communication through the user agents can be monitored. Because of these weaknesses, several attacks to the protocol have now been put forward. This document introduces the ability to send request parameters in a JSON Web Token (JWT) instead, which allows the request to be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained. The request can be sent by value or by reference.
Publication Date
2021-08-01
Status Note
Proposed Standard
DOI
10.17487/RFC9101
Link
https://doi.org/10.17487/RFC9101
Author(s)
Nat Sakimura
John Bradley
Michael B. Jones
Keyword(s)
OAuth, JSON, JWT, JWS, JWE
Latest version of IETF RFC 9101

Document Versions — IETF RFC 9101

  • ▶ IETF RFC 9101 (2021-08-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9101.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 9101, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). Available at https://doi.org/10.17487/RFC9101
Snippet:
IETF RFC 9101, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). Available at https://doi.org/10.17487/RFC9101

HTML (ISO 690 compliant)

Preview:
IETF RFC 9101, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). Available at https://doi.org/10.17487/RFC9101
Snippet:
<span class="citation"><cite>IETF RFC 9101</cite>, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). Available at <a href="https://doi.org/10.17487/RFC9101" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9101</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 9101, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
doi: 10.17487/RFC9101
url: https://doi.org/10.17487/RFC9101
Snippet:
<li>
<cite id="bib-rfc9101">IETF RFC 9101</cite>, The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
<span class="doi">10.17487/RFC9101</span>
</li>

Referenced By