JWT-grant as a new Oauth2 flow
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 6
- Forks
- 3
- Avg merge
- 1h 54m
- Merged PRs (30d)
- 1
Description
RFC7523 extends Oauth2 by using JWTs as grants.
It would be nice if this behaviour could be added as a new type of flow under the Oauth2 securityScheme, in addition to existing ones (authorizationCode, implicit, etc.)
The full name in the RFC is urn:ietf:params:oauth:grant-type:jwt-bearer, but I guess JWT will suffice. Apart from that, the tokenUrl and scopes would be needed.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading RFC 7523 and comparing the existing authorizationCode and implicit flows under the OAuth2 securityScheme. Determine how a JWT grant should expose the specified tokenUrl and scopes, then confirm the expected security scheme shape and validation coverage.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100