Re: [OAUTH-WG] [EXTERNAL] Re: JWT Secured Authorization Request (JAR) vs OIDC request object

Joseph Heenan <> Sat, 18 January 2020 00:17 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id AC03B120091 for <>; Fri, 17 Jan 2020 16:17:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id xh4Y9_UTzbzN for <>; Fri, 17 Jan 2020 16:17:35 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::1036]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DF59A12006B for <>; Fri, 17 Jan 2020 16:17:34 -0800 (PST)
Received: by with SMTP id kx11so3856993pjb.4 for <>; Fri, 17 Jan 2020 16:17:34 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=9Ys2xdJykR81hA/kS9ZiENcLJo3RAooyB2kclhe+Fbw=; b=ve6cseXnwKlqFZHVLNPMxQiXMZmInPpT7bVDBB9IOc4sIRlqqu1kg/LtEaGQolgGRh GjVIEIQbE0tzHUUa1AbCXBcApMwGn56l5B5hSVEy1WNoY9ms0p7Xu50f3Jx2bK1pR+T2 1MsjtN6GuUs8joOvEYJtzAoFqi1y3kMoTvlVKF1dnvAwCsGwIwXdywfBwMeP+ydiPnnc kLJxp3bz7pxjizjTjBeLE+DvDk2oyzWqtrqust8S+gcmXZxISFQVZ2MHPqLR2kmHxY5l w3ajFtNSmTSqosjJ5vV84ylg04Dulc3vk9AKw4fLbPUbawKSji4OzAvAGsjYse3/3kkQ mk1Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=9Ys2xdJykR81hA/kS9ZiENcLJo3RAooyB2kclhe+Fbw=; b=gZow5t6Pgs4x6qrg78Sen/RIK2xnC81EYqKOTh35GGXPV6aZJn/Jan8BIn2Rq0Oo1D Ke9WsCDkSFQZjq8+wPmG8QyOzC5Wr0any9RdydGfrigkcp+/DRzZMKgBVG42sPfvzh4E jemkqFLrOasdGR8OQTTNFDCQrtM0H0qjsFoDWS1HcgdHGtcFsvXcDtwhyMkj2L2K/98/ ZNpJszJL+VqULNdpx2fJmisIbjrAasJIg+mP/uh+Jm2jchZrDBq4oMzOVKhZtEwSEWVp 4OG2idkkLWikpyIm2qF8BFhflt2/lH9Gx55f/Bf/Hul3ujKZqGaDf8oBLZ/uHij14qvt 0w6g==
X-Gm-Message-State: APjAAAUchAz6LAyL/KHZzvc1dRGqkvLcxzc2sq4wblHSRy98T9yJyBGC mRU4GoCdXr0e9Mdb4TgW96mz+A8aY6g=
X-Google-Smtp-Source: APXvYqxSYhg1wOpuuBpiLlbYrrVpa1n5OfMcL59JPZ6VhKZ2Le+nY/CcwkMlmPG1o/FQv1O1LdNmFw==
X-Received: by 2002:a17:90b:145:: with SMTP id em5mr8816146pjb.20.1579306654246; Fri, 17 Jan 2020 16:17:34 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id p17sm29838015pfn.31.2020. (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Jan 2020 16:17:33 -0800 (PST)
From: Joseph Heenan <>
Message-Id: <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_7933E829-BEAD-4DE4-B96D-E67AD9FD7C0A"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Sat, 18 Jan 2020 09:17:30 +0900
In-Reply-To: <>
Cc: Justin Richer <>, oauth <>
To: "Richard Backman, Annabelle" <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <>
Subject: Re: [OAUTH-WG] [EXTERNAL] Re: JWT Secured Authorization Request (JAR) vs OIDC request object
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 18 Jan 2020 00:17:38 -0000

In my opinion it's still problematic if an attacker can inject claims that aren't in the request object.

A simple (albeit OIDC specific) example would injecting prompt=none or a login_hint, where the request object doesn't have a prompt/login_hint already. In that case if/when people design protocol extensions they have to consider in each case what will happen if a client doesn't specify it (and hence the attacker can inject it) rather than being sure that the values they get will always be genuinely sent by the client if the client is using JAR. (I’m not clear if injecting prompt/login_hint can actually be formed into a useful attack, but I’d don’t think that justifies leaving the whole vector open.)

If there’s really a case for having parameters outside the signed object, it feels like the signed object should explicitly list which unsigned parameters it allows to be used with it. That would mean existing OIDC clients aren’t compatible with JAR. I’m not sure the extra complexity is justified.

I think it’s also arguable that if using PAR the case for ignoring all parameters that are outside the request object is even stronger. We quickly give up some of the easy security gains of PAR if we allow it, and whilst I concede there may be some sensible use cases for pre-signed objects mixed with unsigned parameters (Justin mentioned one of combining a pre-signed request object containing scope/client_id/redirect_uri with unsigned nonce/state/code_challenge) I’m not sure there’s any reason to do this when using PAR.


> On 18 Jan 2020, at 01:24, Richard Backman, Annabelle <> wrote:
> +1 to Justin’s comments. From a security standpoint parameters in the query  string are no different from those in JWT unprotected headers (or protected if they’re also in the request object). Although I‘d amend Justin’s suggestion to say that if a parameter is both inside the request object and outside and they do not match, reject the request as suspicious.
>> On Jan 17, 2020, at 5:45 AM, Justin Richer <> wrote:
>>  I don’t agree with this stance from a security or implementation perspective. 
>> If there’s a clear order of precedence for the information, it’s not particularly problematic. Everything inside the request object is to be taken over things outside the request object. We have the exact same semantics and process with dynamic registration, where the software statement is carried alongside plain JSON claims, and the two are mixed with a very simple algorithm:
>>  - If a field is inside the signed payload, use that value and ignore any copy of it on the outside
>>  - If a field is not inside the signed payload and is outside the signed payload, use the outside value
>> Can someone please point out a concrete security issue with this algorithm? This is the extent of the “merge” semantics that we need here, and it would solve not only the ability to use this for use cases that call for a more static request object (perhaps signed by a third party and not the client) along side the plain parameters that can vary, but also the backwards compatibility issue that’s been discussed. With this algorithm in place, you could have OIDC clients actually be compliant with the spec, since OIDC requires replication of the values inside the request object on the outside with exact matches. An OIDC server wouldn’t be fully compliant with the new spec since it would reject some compliant JAR requests that are missing the external parameters, but that’s fairly easy logic to add on the OIDC side. And in that case you get a matrix of compatibility like:
>>               JAR Server | OIDC Server  |
>> ------------+------------+--------------+
>> JAR Client  |     YES    |      NO      |
>> OIDC Client |     YES    |     YES      |
>> Breaking one out of the four possible combinations in a very predictable way is, I think, the best way to handle backwards compatibility here. 
>> But between this issue and JAR’s problematic call for the value of a request_uri to always be a JWT and be fetchable by the AS (neither of which are true in the case of PAR) makes me think we need to pull this back and rework those things, in a push back to the IESG’s comments.
>>  — Justin
>>> On Jan 16, 2020, at 7:38 PM, Joseph Heenan < <>> wrote:
>>> I agree with this, particularly the security concerns of merging. If we merge, we can much guarantee there will eventually be a security issue where an attacker is able to gain an advantage by adding a parameter to the url query (which the server would then happily process if that parameter isn’t found inside the request object). Ruling out that case makes security analysis (particularly when creating new OAuth2 parameters) significantly simpler.
>>> Putting the iss in the JWE header and having the client_id duplicated outside the request object seem to address all the concerns I’ve seen raised.
>>> (It seems like it may be unnecessary to have the client_id duplicated outside if the request_uri is a PAR one though.)
>>> Joseph
>>>> On 16 Jan 2020, at 22:40, John Bradley < <>> wrote:
>>>> I agree with the IESG reasoning that merging is problimatic.  Once we
>>>> allow that given a unknown list of possible paramaters with diffrent
>>>> security properties it would be quite difficult to specify safely.
>>>> Query paramaters can still be sent outside the JAR, but if they are in
>>>> the OAuth registry the AS MUST ignore them.
>>>> Puting the iss in the JWE headder addresses the encryption issue without
>>>> merging.
>>>> I understand that some existing servers have dependencys on getting the
>>>> clientID as a query paramater.
>>>> Is that the only paramater that people have a issue with as oposed to a
>>>> nice to have?
>>>> Would allowing the AS to not ignore the clientID as a query paramater as
>>>> long as it matches the one inside the JAR, basicly the same as Connect
>>>> request object but for just the one paramater make life easier for the
>>>> servers?
>>>> I am not promising a change but gathering info before proposing something.
>>>> John B.
>>>> On 1/16/2020 1:53 AM, Benjamin Kaduk wrote:
>>>>> On Wed, Jan 15, 2020 at 11:02:33PM +0200, Vladimir Dzhuvinov wrote:
>>>>>> On 14/01/2020 19:20, Takahiko Kawasaki wrote:
>>>>>>> Well, embedding a client_id claim in the JWE header in order to
>>>>>>> achieve "request parameters outside the request object should not be
>>>>>>> referred to" is like "putting the cart before the horse". Why do we
>>>>>>> have to avoid using the traditional client_id request parameter so
>>>>>>> stubbornly?
>>>>>>> The last paragraph of Section 3.2.1
>>>>>>> < <>> of RFC 6749 says
>>>>>>> as follows.
>>>>>>>   /A client MAY use the "client_id" request parameter to identify
>>>>>>>   itself when sending requests to the token endpoint.  In the
>>>>>>>   "authorization_code" "grant_type" request to the token endpoint,
>>>>>>>   *an unauthenticated client MUST send its "client_id" to prevent
>>>>>>>   itself from inadvertently accepting a code intended for a client
>>>>>>>   with a different "client_id".*  This protects the client from
>>>>>>>   substitution of the authentication code.  (It provides no
>>>>>>>   additional security for the protected resource.)/
>>>>>>> If the same reasoning applies, a client_id must always be sent with
>>>>>>> request / request_uri because client authentication is not performed
>>>>>>> at the authorization endpoint. In other words, */an unauthenticated
>>>>>>> client (every client is unauthenticated at the authorization endpoint)
>>>>>>> MUST send its "client_id" to prevent itself from inadvertently
>>>>>>> accepting a request object for a client with a different "client_id"./*
>>>>>> Identifying the client in JAR request_uri requests can be really useful
>>>>>> so that an AS which requires request_uri registration to prevent DDoS
>>>>>> attacks and other checks can do those without having to index all
>>>>>> request_uris individually. I mentioned this before.
>>>>>> I really wonder what the reasoning of the IESG reviewers was to insist
>>>>>> on no params outside the JAR JWT / request_uri.
>>>>>> I'm beginning to realise this step of the review process isn't
>>>>>> particularly transparent to WG members.
>>>>> Could you expand on that a bit more?  My understanding is that the IESG
>>>>> ballot mail gets copied to the WG precisely so that there is transparency,
>>>>> e.g., the thread starting at
>>>>> <>
>>>>> Which admittely is from almost three years ago, but that's the earliest
>>>>> that I found that could be seen as the source of this behavior.
>>>>> -Ben
>>>>> P.S. some other discussion at
>>>>> and
>>>>> and
>>>>> so on.
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> <>
>>> _______________________________________________
>>> OAuth mailing list
>>> <>
>> _______________________________________________
>> OAuth mailing list