aaronpk / oauth-first-party-apps

https://datatracker.ietf.org/doc/html/draft-parecki-oauth-first-party-apps
Other
10 stars 8 forks source link

For PAR, PAR endpoint should be used. #105

Open Sakurann opened 1 month ago

Sakurann commented 1 month ago

from section 5.2.2.1,

This enables the authorization server to essentially treat the authorization challenge request as a PAR [RFC9126] request, and return the request_uri and expires_in as defined by [RFC9126] in the error response. The client then uses the request_uri value to build an authorization request as defined in [RFC9126] Section 4.

It does not sound right and feels like an over optimization to use this new authorization challenge endpoint as a PAR endpoint. for PAR, PAR endpoint needs to be used. that would also allow removing code_challenge and code_challenge_method from this specification and simplify it.