Senior LevelAuthentication & Authorization
What is OAuth 2.0 Pushed Authorization Requests (PAR / RFC 9126) and why does it enhance security?
❓ Interview Prompt: Explain OAuth 2.0 Pushed Authorization Requests (PAR), request_uri handles, URL parameter privacy, and front-channel security.
In standard OAuth 2.0, all authorization parameters ('client_id', 'redirect_uri', 'scope', 'state', 'code_challenge') are passed in the front-channel browser URL as GET query strings. This leaks sensitive parameters to browser history, server logs, and referrer headers. Pushed Authorization Requests (PAR) (RFC 9126) solves this.
PAR Execution Steps:
1
Back-Channel POST: Client pushes all authorization parameters directly to the Auth Server's '/par' endpoint via an authenticated POST request.
2
Request URI Handle: Auth Server validates parameters and returns a short-lived opaque 'request_uri' handle (e.g. 'urn:ietf:params:oauth:request_uri:req_abc123').
3
Clean Front-Channel Redirect: Client redirects browser passing ONLY the 'request_uri' and 'client_id':
'GET /authorize?client_id=my_client&request_uri=urn:ietf:params:oauth:request_uri:req_abc123'
4
Security Benefit: Prevents parameter tampering in the browser and keeps authorization parameters out of access logs.
Code Implementation Example
typescript
async function initiateParAuthorizationFlow(): Promise<string> {
// 1. Push authorization parameters directly to Auth Server back-channel /par endpoint
const parRes = await fetch('https://auth.company.com/oauth/par', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': 'Basic ' + Buffer.from(CLIENT_ID + ':' + CLIENT_SECRET).toString('base64')
},
body: new URLSearchParams({
response_type: 'code',
redirect_uri: 'https://app.company.com/callback',
scope: 'openid profile payments',
code_challenge: pkceChallenge,
code_challenge_method: 'S256'
})
});
const { request_uri } = await parRes.json();
// 2. Redirect browser passing ONLY the opaque request_uri handle!
return "https://auth.company.com/authorize?client_id=" + CLIENT_ID + "&request_uri=" + encodeURIComponent(request_uri);
}💡Pushing OAuth parameters to PAR endpoint and obtaining opaque request_uri handle.
🎯 Interview Key Takeaway
PAR (RFC 9126) pushes authorization parameters via back-channel POST requests, preventing URL parameter tampering and log leakage.
#PAR#RFC 9126#OAuth 2.0#Security#Senior
Back to all Authentication & Authorization Questions→