OAuth 2.0 Pushed Authorization Requests

[@vladislavzubov2818]

Perfect explanation. Thank you for your work man!

[@jgoebel]

Glad it was helpful!

[@ArvindKumar-oz6jg]

If an attacker gets hold of the returned request-uri and client-id, there is no way for AS to determine whether the request coming to it is from right source? Seems solved with MTLS client auth

[@jgoebel]

Pushed Authorization Requests essentially protect against a malicious app starting an OAuth flow and requesting more scopes than needed. Even if you do get the request URI, the end user still needs to authenticate. So PARs can add value in high security deployments.

[@ArvindKumar-oz6jg]

@@jgoebel are you active on LinkedIn, would like to connect

[@jgoebel]

@@ArvindKumar-oz6jg yes, the link is in the channel banner on the top right (the LinkedIn symbol) or on my website