RFC 9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
In plain English — editorial summary, not part of the RFC
The authorization request in OAuth 2.0 described in RFC 6749 utilizes query parameter serialization, which means that authorization request parameters are encoded in the URI of the request and sent through user agents such as web browsers. While it is easy to implement, it means that a) the communication through the user agents is not integrity protected and thus, the parameters can be tainted, b) the source of the communication is not authenticated, and c) the communication through the user agents can be monitored. Because of these weaknesses, several attacks to the protocol have now been put forward. This document introduces the ability to send request parameters in a JSON Web Token (JWT) instead, which allows the request to be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained. The request can be sent by value or by reference.
Document record
- Document ID
- RFC9101
- Published
- August 2021
- Authors
- N. Sakimura; J. Bradley; M. Jones
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- sec
- Pages
- 25
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 7519JSON Web Token (JWT)Updated
May 2015
- RFC 8725JSON Web Token Best Current PracticesCurrent
February 2020
- RFC 7520Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE)Current
May 2015
- RFC 7517JSON Web Key (JWK)Current
May 2015
- RFC 7516JSON Web Encryption (JWE)Current
May 2015
- RFC 7515JSON Web Signature (JWS)Current
May 2015
- RFC 9728OAuth 2.0 Protected Resource MetadataCurrent
April 2025
- RFC 8414OAuth 2.0 Authorization Server MetadataCurrent
June 2018
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?