Adopt Pushed Authorization Requests
- Dominant language
- HTML
- Stars
- 57
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
[Pushed Authorization Requests](https://oauth.net/2/pushed-authorization-requests/) is still an early OAuth 2.0 draft, but is a good candidate for IndieAuth as well as it provides better overall security.
Instead of first building a URL with the authorization request and redirecting the user's browser to that URL, the first step is to send a POST with the request details to the authorization endpoint, and then redirecting the user's browser to the authorization endpoint with an opaque string returned from the previous step.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue does not name files, tests, or entry points. Start by reviewing the existing IndieAuth authorization flow and the linked Pushed Authorization Requests description. Done means IndieAuth supports the described POST-first flow and browser redirect using the returned opaque value.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100