Subject: [OAUTH-WG] A *Short* 3rd WGLC on "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens"

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 5 May 2020 14:18:24 -0400

Hi all,

This is a 3rd working group last call for "JSON Web Token (JWT) Profile for
OAuth 2.0 Access Tokens".

Here is the document:

https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07

Please send your comments to the OAuth mailing list by May 12, 2020.

Regards,

 Rifaat & Hannes

---

From: Prabath Siriwardena <[email-masked]>
Date: Thu, 7 May 2020 11:56:34 -0700

Hi all,

Can we say in [1], that the AS should add the value of *state* parameter
from the authorization request (if present), to the JWT access token it
generates?

This will help to address token injection issue [2], with respect to the
implicit grant type.

Appreciate your thoughts on this.

[1]: https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07
[2]:
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-4.6

Thanks
-Prabath

On Tue, May 5, 2020 at 11:19 AM Rifaat Shekh-Yusef <[email-masked]>
wrote:

> Hi all,
>
>
>
> This is a 3rd working group last call for "JSON Web Token (JWT) Profile
> for OAuth 2.0 Access Tokens".
>
>
>
> Here is the document:
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Vittorio Bertocci <[email-masked]>
Date: Thu, 7 May 2020 20:29:38 +0000

Hi Prabath,
Thanks for your comment! Here are my thoughts.
I don’t believe embedding the state in the AT would help. The state is generated (hence verified, if used for protection) by the client, but the content of the AT is really meant for the RS, which has no direct knowledge of what the state value should be, not in the first nor all the subsequent uses of the AT within its validity period. Also, the client itself is forbidden to inspect the content of the access token- you can find the details behind that in recent discussions on the list.
I’ll add to this that the implicit grant is on its way out of the grants stage, hence doing major changes to accommodate its quirks wouldn’t give a lot of ROI.
HTH
Thanks!
V.

From: OAuth <[email-masked]> on behalf of Prabath Siriwardena <prabath=[email-masked]>
Date: Thursday, May 7, 2020 at 11:56
To: Rifaat Shekh-Yusef <[email-masked]>, oauth <[email-masked]>
Subject: [OAUTH-WG] [JWT Profile for OAuth 2.0 Access Tokens] Adding state into the JWT

Hi all,

Can we say in [1], that the AS should add the value of state parameter from the authorization request (if present), to the JWT access token it generates?

This will help to address token injection issue [2], with respect to the implicit grant type.

[1]: https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07
[2]: https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15#section-4.6

Thanks
-Prabath

On Tue, May 5, 2020 at 11:19 AM Rifaat Shekh-Yusef <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

This is a 3rd working group last call for "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens".

Here is the document:

Regards,
 Rifaat & Hannes
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Prabath Siriwardena <[email-masked]>
Date: Thu, 7 May 2020 19:29:08 -0700

Thanks Vittorio for your thoughts!

On Thu, May 7, 2020 at 1:29 PM Vittorio Bertocci <vittorio.bertocci=
[email-masked]> wrote:

> I don’t believe embedding the state in the AT would help. The state is
> generated (hence verified, if used for protection) by the client, but the
> content of the AT is really meant for the RS, which has no direct knowledge
> of what the state value should be, not in the first nor all the subsequent
> uses of the AT within its validity period. Also, the client itself is
> forbidden to inspect the content of the access token- you can find the
> details behind that in recent discussions on the list.
>
> I’ll add to this that the implicit grant is on its way out of the grants
> stage, hence doing major changes to accommodate its quirks wouldn’t give a
> lot of ROI.
>
> HTH
>
> Thanks!
>
> V.
>
>
>
> *From: *OAuth <[email-masked]> on behalf of Prabath Siriwardena
> <prabath=[email-masked]>
> *Date: *Thursday, May 7, 2020 at 11:56
> *To: *Rifaat Shekh-Yusef <[email-masked]>, oauth <[email-masked]>
> *Subject: *[OAUTH-WG] [JWT Profile for OAuth 2.0 Access Tokens] Adding
> state into the JWT
>
>
>
> Hi all,
>
>
>