← All practicals

Harden the front channel (PAR + JARM)

Push your authorization request over a back channel, then get a signed, tamper-evident response back.

1. 1

   On the Demo app, turn on “Push via PAR” and sign in.

   RFC 9126: instead of the browser redirect carrying every authorization param in the open, the app POSTs them to /oidc/par over a back channel first and gets back a one-time request_uri — the redirect now carries only client_id + request_uri, nothing left to tamper with.

2. 2

   Turn on “Sign response via JARM” and sign in again.

   RFC 9101 §5: with response_mode=query.jwt, the Lab signs the WHOLE authorization response — code, state, iss — as one ES256 JWT. A network device that swaps the code in flight breaks the signature; you verify it exactly like the ID token.

3. 3

   Try both together, then watch the X-ray for oidc.par_pushed and oidc.jarm_issued.

   The two are independent and composable: PAR protects the REQUEST, JARM protects the RESPONSE — a full round trip with nothing readable-and-mutable left in the browser’s address bar.