Subject: Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: PAR: pushed requests must become JWTs

From: Aaron Parecki <[email-masked]>
Date: Thu, 23 Jul 2020 15:49:50 -0700

I know this is a bit of an old thread to dig up, but as I'm working through
this draft again, something is sticking out to me about this.

In every other instance of "*_uri" in OAuth and extensions, the value is a
URI (usually https) which will be visited by the user's browser or be sent
a POST request from a client. In the case of PAR, this "request_uri" is
actually just an identifier that is *added* to an existing URL, the
authorization endpoint, not a URL that will be visited itself. This
discrepancy is bothering me.

I would have expected that either:

* The PAR response includes a "request_uri" which is the full URL that the
client would redirect the user's browser to, OR
* The PAR response includes a "request_id" which it adds in the query
string to the authorization endpoint and then redirects the browser to

For example:

POST /as/par HTTP/1.1
...
response:
{
      "request_uri": "
https://as.example.com/auth?request=bwc4JK-ESC0w8acc191e-Y1LTC2",
      "expires_in": 60
}

then the user's browser is sent to whatever the value of "request_uri" is

OR

POST /as/par HTTP/1.1
...
response:
{
      "request_id":
"urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2",
      "expires_in": 60
}

then the "request_id" is added to the authorization endpoint (as currently
described by PAR)

https://as.example.com/auth?
client_id=s6BhdRkqt3&request_uri=urn%3Aietf%3Aparams
%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2

My personal preference is the first option, keeping the term "request_uri"
but having it actually be the full URI, to simplify the job of the client.
In that model, the client doesn't have to mess with building URLs, and
actually provides additional flexibility for the AS as well since that
endpoint no longer needs to be the exact same URL as the authorization
endpoint.

---
Aaron Parecki
https://aaronparecki.com

On Thu, Jan 16, 2020 at 8:25 AM Torsten Lodderstedt <torsten=
[email-masked]> wrote:

> I just thought about another option. What if we change PAR to not use the
> request_uri parameter but a new parameter, e.g. request_id?
>
> That would decouple both specs. The reason why we use request_uri was to
> make the life of clients easier since they can use the standard library
> function for request objects to pass the PAR reference to the AS. Is this
> worth the trouble?
>
> Am 16.01.2020 um 16:48 schrieb Justin Richer <[email-masked]>:
>
> +1 to this approach, and it sounds like JAR might need to come back to go
> through another round anyway thanks to the breaking changes the IESG pushed
> into it after it left WGLC.
>
> I’d rather see us get this right than publish something many of us think
> is broken.
>
> Maybe PAR and JAR (and JARM?) end up going out as a bundle of specs.
>
>  — Justin
>
>
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 24 Jul 2020 09:12:19 +0200

Hi Aaron, 

that’s a very good point. I was also in favour of just providing the client with the URL it needs to send the user to (like XYZ and OAuth do). 

In the end, we decided to stay with the current approach since it fits with the rest of the existing ecosystem, namely JAR and authorization endpoint discovery. 

best regards,
Torsten. 

> On 24. Jul 2020, at 00:49, Aaron Parecki <[email-masked]> wrote:
> 
> I know this is a bit of an old thread to dig up, but as I'm working through this draft again, something is sticking out to me about this.
> 
> In every other instance of "*_uri" in OAuth and extensions, the value is a URI (usually https) which will be visited by the user's browser or be sent a POST request from a client. In the case of PAR, this "request_uri" is actually just an identifier that is *added* to an existing URL, the authorization endpoint, not a URL that will be visited itself. This discrepancy is bothering me.
> 
> * The PAR response includes a "request_uri" which is the full URL that the client would redirect the user's browser to, OR
> * The PAR response includes a "request_id" which it adds in the query string to the authorization endpoint and then redirects the browser to
> 
> For example:
> 
> POST /as/par HTTP/1.1
> ...
> response:
> {
>       "request_uri": "https://as.example.com/auth?request=bwc4JK-ESC0w8acc191e-Y1LTC2",
>       "expires_in": 60
> }
> 
> POST /as/par HTTP/1..1
>       "request_id": "urn:ietf:params:oauth:request_uri:bwc4JK-ESC0w8acc191e-Y1LTC2",
>       "expires_in": 60
> }
> 
> then the "request_id" is added to the authorization endpoint (as currently described by PAR)
> 
> https://as.example.com/auth?client_id=s6BhdRkqt3&request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3Abwc4JK-ESC0w8acc191e-Y1LTC2
> 
> My personal preference is the first option, keeping the term "request_uri" but having it actually be the full URI, to simplify the job of the client. In that model, the client doesn't have to mess with building URLs, and actually provides additional flexibility for the AS as well since that endpoint no longer needs to be the exact same URL as the authorization endpoint.. 
> 
> ---
> Aaron Parecki
> https://aaronparecki.com
> 
> 
> On Thu, Jan 16, 2020 at 8:25 AM Torsten Lodderstedt <torsten=[email-masked]> wrote:
> I just thought about another option. What if we change PAR to not use the request_uri parameter but a new parameter, e.g. request_id?
> 
> That would decouple both specs. The reason why we use request_uri was to make the life of clients easier since they can use the standard library function for request objects to pass the PAR reference to the AS. Is this worth the trouble?
> 
>> +1 to this approach, and it sounds like JAR might need to come back to go through another round anyway thanks to the breaking changes the IESG pushed into it after it left WGLC.
>> 
>> I’d rather see us get this right than publish something many of us think is broken. 
>> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Justin Richer <[email-masked]>
Date: Thu, 30 Jul 2020 07:27:36 -0400

Aaron,

The “request_uri” comes from OIDC originally, and is redefined in JAR. The original idea was to have a URL that the AS/IdP would be able to fetch to get a Request Object from, which is why JAR used to have language about “it MUST be fetchable and resolve to a JWT” (or something like that). JAR has backed off that requirement now (I believe), but those roots are still in the name. RAR opts to re-use that mechanism instead of inventing either a new parameter or returning a full Redirection URI.

 — Justin

> On Jul 24, 2020, at 3:12 AM, Torsten Lodderstedt <torsten=[email-masked]> wrote:
> 
> Hi Aaron, 
>