Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-jwsreq-21.txt

Brian Campbell <> Tue, 21 April 2020 13:13 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CE3A73A0C04 for <>; Tue, 21 Apr 2020 06:13:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id U-TdNPwITkJ3 for <>; Tue, 21 Apr 2020 06:13:06 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id A6AD53A0C0B for <>; Tue, 21 Apr 2020 06:13:05 -0700 (PDT)
Received: by with SMTP id a21so601498ljb.9 for <>; Tue, 21 Apr 2020 06:13:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=JZ4wd9Riq8CzLZG+ci6FBmrIBrDnp0zJ4bAyTiWzQYs=; b=Kmq3UM1So6tIqNqhweBoxCzOXJgSwEPSEfmC6aZ9INxl2MD88oHu32oweVRhqqJAFD NaAew64ujoxxAf72Ll8qJaCfhq2WN9LkwvHfRWJEh78v+LbwAG4+yWNGgwPwWe6gnDWl znLBRHvWxm58I0MNiHByRYqJicixlJkWYW+4NWIunRweHV7ki4PU95D5qkhorXls9HAV fFrKJojDhWLaQnjL/tJ+0zTG8QZSxjJ//OV4uXD+Iq5iB2lwGZAFBg+Ow3U9tc/PvjNq UWvVBOw7at8LZU0w4CjDTX4+EWjPiVfelNjfhsyrXXI9ZbAL83npxCY9sYaTZJkztOam 0k6A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=JZ4wd9Riq8CzLZG+ci6FBmrIBrDnp0zJ4bAyTiWzQYs=; b=UtPUSvghU8gTTu60N7pp1zlEPFEdQ/1wRCWY0X2IwPxHv6xtJhWUZQz0vtxT6llkUP zmbEnv/aA8QP8SP2wE5XdRDcCnOtyV4BOiNscyUxUx7ctQkwfmKimWFc5RaXSB4mvFTX WbHxMaheHyow0nYzMYzCxE0SXtVlVhuTknUb5yEB0WrxpNaakAXQzUg/cZjR64UZ6z+W hJo9zL9aOCkjV5hhvIRa89p0MDoY6xb2YEy7R4KHsEbUsvwJN3696OKqCBVUKYRFhlKd opIGf+F8vFYlpK0750IhZzzbBwnqyL9tkbcC4fvy4Z+o7tDE4HfTZCGHtL4s11dMIN8C V5Cg==
X-Gm-Message-State: AGi0PuboDf3lcWO3IiDVmhWbzjrW+msnKQey9mdLI8mLs2ixtdiRsQZo k//9S6J5GnlOuk0i8F/v6P7Aim+VORZh3ohu5T39KOzQFEBFCSsnJ02fT33IMHSMICzcgqldLVi 24jPWCaCb/kS9pgO+z9U=
X-Google-Smtp-Source: APiQypIUH59p6lY0+oSyV9jH3hYqsLUvHhy2g+otlC2AHgiaQ7ZK0Wzn49ATBrUZAfddK6VUxN4oa2KgDYZAJK/OJhU=
X-Received: by 2002:a2e:3813:: with SMTP id f19mr12977100lja.216.1587474783812; Tue, 21 Apr 2020 06:13:03 -0700 (PDT)
MIME-Version: 1.0
References: <> <>
In-Reply-To: <>
From: Brian Campbell <>
Date: Tue, 21 Apr 2020 07:12:37 -0600
Message-ID: <>
To: Vladimir Dzhuvinov <>
Cc: oauth <>
Content-Type: multipart/alternative; boundary="000000000000947cdb05a3ccc63b"
Archived-At: <>
Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-jwsreq-21.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 21 Apr 2020 13:13:08 -0000

I'd agree that Vladimir's proposed wording is more meaningful/helpful.

On Mon, Apr 20, 2020 at 12:12 AM Vladimir Dzhuvinov <>

> Nat, John, thanks for updating the JAR spec. I just reviewed it, in
> particular the authz request and the security considerations sections.
> Choosing to make client_id (as top-level parameter) mandatory for all
> cases, even for those when it can be readily extracted from the JWT, makes
> the job of implementers even easier.
> I have just one comment about the last paragraph in section 5, assuming
> backward compatibility means with RFC6749 requests. Here is my proposed
> wording:
> The client MAY send the parameters included in the request object
> duplicated in the query parameters. For instance, this can be done
> to ensure the minimal required query parameters for an OAuth 2.0
> [RFC6749] authorization request are also present. An authorization
> server supporting this specification MUST however only use the
> parameters included in the request object.
> Vladimir
> On 19/04/2020 21:30, wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Web Authorization Protocol WG of the IETF.
>         Title           : The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)
>         Authors         : Nat Sakimura
>                           John Bradley
> 	Filename        : draft-ietf-oauth-jwsreq-21.txt
> 	Pages           : 31
> 	Date            : 2020-04-19
> Abstract:
>    The authorization request in OAuth 2.0 described in RFC 6749 utilizes
>    query parameter serialization, which means that Authorization Request
>    parameters are encoded in the URI of the request and sent through
>    user agents such as web browsers.  While it is easy to implement, it
>    means that (a) the communication through the user agents are not
>    integrity protected and thus the parameters can be tainted, and (b)
>    the source of the communication is not authenticated.  Because of
>    these weaknesses, several attacks to the protocol have now been put
>    forward.
>    This document introduces the ability to send request parameters in a
>    JSON Web Token (JWT) instead, which allows the request to be signed
>    with JSON Web Signature (JWS) and encrypted with JSON Web Encryption
>    (JWE) so that the integrity, source authentication and
>    confidentiality property of the Authorization Request is attained.
>    The request can be sent by value or by reference.
> The IETF datatracker status page for this draft is:
> There are also htmlized versions available at:
> A diff from the previous version is available at:
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at
> Internet-Drafts are also available by anonymous FTP at:
> _______________________________________________
> OAuth mailing list

_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._