OAI / OAI/sig-security

JWT-grant as a new Oauth2 flow

Open
#19 9 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
6
Forks
3
Avg merge
1h 54m
Merged PRs (30d)
1

Description

RFC7523 extends Oauth2 by using JWTs as grants.

It would be nice if this behaviour could be added as a new type of flow under the Oauth2 securityScheme, in addition to existing ones (authorizationCode, implicit, etc.)

The full name in the RFC is urn:ietf:params:oauth:grant-type:jwt-bearer, but I guess JWT will suffice. Apart from that, the tokenUrl and scopes would be needed.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading RFC 7523 and comparing the existing authorizationCode and implicit flows under the OAuth2 securityScheme. Determine how a JWT grant should expose the specified tokenUrl and scopes, then confirm the expected security scheme shape and validation coverage.

Written by the indexing model from the issue text.

Assessment

Domain
api, authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.