Subject: [OAUTH-WG] OAuth 2.0 JWT Secured Authorization Request (JAR) updates addressing remaining review comments

From: Mike Jones <[email-masked]>
Date: Fri, 19 Mar 2021 20:41:42 +0000

After the OAuth 2.0 JWT Secured Authorization Request (JAR) specification was sent to the RFC Editor<https://self-issued.info/?p=2121>, the IESG requested an additional round of IETF feedback.  We've published an updated draft addressing the remaining review comments, specifically, SecDir comments from Watson Ladd.  The only normative change made since draft 28 was to change the MIME Type from "oauth.authz.req+jwt" to "oauth-authz-req+jwt", per advice from the designated experts.

As a reminder, this specification takes the JWT Request Object from Section 6 of OpenID Connect Core (Passing Request Parameters as JWTs)<https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests> and makes this functionality available for pure OAuth 2.0 applications - and does so without introducing breaking changes.  This is one of a series of specifications bringing functionality originally developed for OpenID Connect to the OAuth 2.0 ecosystem.  Other such specifications included OAuth 2.0 Dynamic Client Registration Protocol [RFC 7591<https://tools.ietf.org/html/rfc7591>] and OAuth 2.0 Authorization Server Metadata [RFC 8414<https://tools.ietf.org/html/rfc8414>].

The specification is available at:

  *   https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-31

An HTML-formatted version is also available at:

  *   https://self-issued.info/docs/draft-ietf-oauth-jwsreq-31.html

                                                       -- Mike

P.S.  This notice was also posted at https://self-issued.info/?p=2152 and as @selfissued<https://twitter.com/selfissued/>.