indieweb / indieweb/indieauth

Adopt Pushed Authorization Requests

Open
#40 5 comments 1 reaction 0 assignees View on GitHub
revisit later
Dominant language
HTML
Stars
57
Forks
7
PR merge metrics
No merged PRs in 30d

Description

[Pushed Authorization Requests](https://oauth.net/2/pushed-authorization-requests/) is still an early OAuth 2.0 draft, but is a good candidate for IndieAuth as well as it provides better overall security.

Instead of first building a URL with the authorization request and redirecting the user's browser to that URL, the first step is to send a POST with the request details to the authorization endpoint, and then redirecting the user's browser to the authorization endpoint with an opaque string returned from the previous step.

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue does not name files, tests, or entry points. Start by reviewing the existing IndieAuth authorization flow and the linked Pushed Authorization Requests description. Done means IndieAuth supports the described POST-first flow and browser redirect using the returned opaque value.

Written by the indexing model from the issue text.

Assessment

Domain
authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.