Feature/pushed authorization requests - #73
Open
andrewclymer wants to merge 27 commits into
Open
Conversation
…tEndpoint and update related logic
…int and update tests
…d to re-think the storage of the PAR request so its flat and use native types so that a store can easily serialize
… ValidatedAuthorizationRequest
…the store. This simplifies the response generator
… opposed to the raw URL. As if the request_uri is intercepted only the client_id is required for an attacker to use it, and bypass the client secret aspect of PAR. Also fixed issue that the RequestValidator was still bound to the store not the service layer
This was
linked to
issues
Sep 7, 2026
JoStevensRSK
reviewed
Sep 8, 2026
|
|
||
| <ItemGroup> | ||
| <PackageReference Include="Open.IdentityServer"/> | ||
| <!-- <PackageReference Include="Open.IdentityServer"/>--> |
Collaborator
There was a problem hiding this comment.
This will break the build
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
|
|
||
| internal record PushedAuthorizationResult(PushedAuthorizationResponse Response) : IEndpointResult | ||
| { | ||
| public async Task ExecuteAsync(HttpContext context) |
Collaborator
There was a problem hiding this comment.
Missing set no cache headers, they appear in the example requests in the spec
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
Collaborator
|
Missing copyright headers on all your new files. Or insert on existing files |
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
JoStevensRSK
reviewed
Sep 8, 2026
… consistency based on PR feedback
…e generator for clarity and consistency
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Initial implementation of PAR. Currently uses an InMemory store for the PAR requests. Looking for feedback and testing of the implementation. Will then work on EF store while this PR is being evaluated
Type of change
Does this PR introduce a breaking change?
Does the change cause existing functionality to not work as previously expected, or does the DB schema or C# public API surface change?
Testing
Full set of unit tests and end to end integration test from PAR request through to getting a token
LLM Usage
Used LLM to confirm the code has implemented PAR as per the RFC.
Other context
None