I-D Action: draft-zehavi-oauth-authz-req-del-chain-01.txt
internet-drafts@ietf.org Thu, 10 September 2026 14:39 UTC
Return-Path: <internet-drafts@ietf.org>
X-Original-To: i-d-announce@ietf.org
Delivered-To: i-d-announce@mail2.ietf.org
Received: from [10.244.8.66] (gaia.k8s.ietf.org [4.156.85.76]) by mail2.ietf.org (Postfix) with ESMTP id E9899138643B9 for <i-d-announce@ietf.org>; Thu, 10 Sep 2026 07:39:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1789051196; bh=5301sedCoyJk/QsELXMCB+BkBF6HvC7ECDIiBAevOeg=; h=From:To:Subject:Date; b=KRAfWfl0LdHwKVh3WjUkzdKGx5FMIn5SuD7Y9S0QTq2lr6qrP0atF5E1+WUIWYRHc IgINWNHzEjw8Qraqcy65MjTXmnYpyMp6GfEACtMC8rxXV78pj8IMt/okCWlfgwX38c Com/xXNqWeQivqXVYn5VaM7KCqZmzEXWYv85DXoc=
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
Subject: I-D Action: draft-zehavi-oauth-authz-req-del-chain-01.txt
X-Test-IDTracker: no
X-IETF-IDTracker: 12.74.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <178905119688.503.4838051683924409216@dt-datatracker-6fdf8b6b57-w7msg>
Date: Thu, 10 Sep 2026 07:39:56 -0700
Message-ID-Hash: MWZ4TTSAPBIK3SESMZJ54OOXYKIEFVSS
X-Message-ID-Hash: MWZ4TTSAPBIK3SESMZJ54OOXYKIEFVSS
X-MailFrom: internet-drafts@ietf.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-i-d-announce.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Reply-To: internet-drafts@ietf.org
List-Id: Internet Draft Announcements only <i-d-announce.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/i-d-announce/wiJloEvlw1jS047Y4Op8QJqZSC8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/i-d-announce>
List-Help: <mailto:i-d-announce-request@ietf.org?subject=help>
List-Owner: <mailto:i-d-announce-owner@ietf.org>
List-Post: <mailto:i-d-announce@ietf.org>
List-Subscribe: <mailto:i-d-announce-join@ietf.org>
List-Unsubscribe: <mailto:i-d-announce-leave@ietf.org>
Internet-Draft draft-zehavi-oauth-authz-req-del-chain-01.txt is now available. Title: OAuth Authorization Request Delegation Chain Author: Yaron Zehavi Name: draft-zehavi-oauth-authz-req-del-chain-01.txt Pages: 43 Dates: 2026-09-10 Abstract: Brokered OAuth redirect authorization requests involve intermediary authorization servers between a downstream client and the upstream authorization server that obtains user consent and issues tokens. Such deployments have security risks because the upstream authorization server sees only the immediate OAuth client and is unaware of the downstream client or intermediary brokers obtaining its response. This document defines an OAuth 2.0 profile for carrying a verifiable, signed authorization request delegation chain as a RAR authorization_details object [RFC9396]. Each node in the chain is a JSON object signed by an attesting authorization server using detached JWS [RFC7515], attesting its validated client, hash-linked to the previous node, allowing the upstream authorization server to validate the integrity of the visible delegation path and apply policy before issuing tokens. The IETF datatracker status page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-zehavi-oauth-authz-req-del-chain/ There is also an HTML version available at: https://www.ietf.org/archive/id/draft-zehavi-oauth-authz-req-del-chain-01.html A diff from the previous version is available at: https://author-tools.ietf.org/iddiff?url2=draft-zehavi-oauth-authz-req-del-chain-01 Internet-Drafts are also available by rsync at: rsync.ietf.org::internet-drafts
- I-D Action: draft-zehavi-oauth-authz-req-del-chai… internet-drafts