Exploring Authorization Endpoint Flows, PAR, and redirect_to_web Interaction type
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
I am trying to understand Authorization Endpoint flows and the relationship between the Pushed Authorization Request (PAR) mechanism and the redirect_to_web interaction type.
From my understanding - PAR vs redirect to web
PARfocuses on making aPOSTto/parwhich responds withrequest_urito which Wallet is supposed to redirect for user authorizationredirect_to_webis an interaction instruction that focuses on Wallet performing initial interaction request and getting the response withrequest_urito which Wallet is expected to redirect for user authorization.
Functionally, both seem to result in the Wallet redirecting the user to a web-based authorization endpoint, which makes them appear similar from a Wallet UX perspective.
I wanted to check:
- Is this distinction (
PARvsredirect_to_webinteraction ) expected to remain separate? - Are there any discussions or plans to align or merge these concepts in future revisions, or is the current separation considered important for clarity and extensibility?
- I would also like to confirm the use of the
authorization_endpointas mentioned in RFC 6749 & RFC 8414 for obtaining anauthorization_code. Could this requirement change in the future? Is it always mandatory for an Issuer (Authorization Server) to support theauthorization_endpoint, even if it expects authorization to occur via user interaction (such as aninteractive_authorization_endpoint)? If so, are there specific scenarios—such as when amissing_interaction_typeerror is returned by the Issuer—where the Wallet may fall back to using theauthorization_endpointfor authorization?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the /par, redirect_to_web, authorization_endpoint, and interactive_authorization_endpoint flows with the cited RFC 6749 and RFC 8414 sections. Done means documenting whether these concepts remain separate, whether authorization_endpoint is mandatory, and how missing_interaction_type affects fallback behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100