Securing OIDC sign-on with Pushed Authorization Requests
PingOne PingOne Advanced Identity Cloud PingAM Android iOS JavaScript
The Orchestration SDK implements Pushed Authorization Requests (PAR, RFC 9126), an OAuth 2.0 extension that improves the security of the OIDC login flows.
In a standard OIDC redirect flow, authorization parameters such as client_id, redirect_uri, scope, and state are sent as query parameters in the browser’s address bar when redirecting to the authorization server.
PAR moves these parameters to a direct, server-side POST request to the authorization server’s /par endpoint before the browser redirect occurs.
The server returns a short-lived request_uri that acts as a reference to the stored parameters, and the browser is redirected to the /authorize endpoint using only that opaque reference.
This approach provides several security benefits:
- Reduced parameter exposure
-
Authorization parameters are no longer visible in browser history, proxy logs, or referrer headers.
- Integrity protection
-
Parameters are submitted directly to the server over a backchannel connection before the redirect, so they cannot be tampered with in transit.
- No URL length limits
-
Complex requests with many parameters, such as those using rich claims or
acr_values, are no longer constrained by browser URL length limits.