Orchestration SDKs

Securing OIDC sign-on with Pushed Authorization Requests

PingOne PingOne Advanced Identity Cloud PingAM Android iOS JavaScript

The Orchestration SDK implements Pushed Authorization Requests (PAR, RFC 9126), an OAuth 2.0 extension that improves the security of the OIDC login flows.

In a standard OIDC redirect flow, authorization parameters such as client_id, redirect_uri, scope, and state are sent as query parameters in the browser’s address bar when redirecting to the authorization server.

PAR moves these parameters to a direct, server-side POST request to the authorization server’s /par endpoint before the browser redirect occurs.

The server returns a short-lived request_uri that acts as a reference to the stored parameters, and the browser is redirected to the /authorize endpoint using only that opaque reference.

AppAuthorization server..User....SDK....Browser....Authorization server..UserUserSDKOrchestration SDKSDKOrchestration SDKBrowserBrowserAuthorization serverPingOne / AIC / PingAMAuthorization serverPingOne / AIC / PingAM1)Initiate sign-on2)POST /par(client_id, scope, redirect_uri,state, code_challenge)Params sent in request body — not visible in URL.Server validates and stores the request.3)request_uri4)Navigate to /authorize(client_id,request_uri)5)GET /authorizeServer retrieves stored params usingrequest_uri.6)Redirect to sign-in page7)Sign-in page8)Authenticate & consent9)Submit credentials10)Redirect with auth code11)Authorization code12)POST /token(code, client_id)13)access_token,refresh_token14)access_token
Figure 1. Summary of the PAR flow

This approach provides several security benefits:

Reduced parameter exposure

Authorization parameters are no longer visible in browser history, proxy logs, or referrer headers.

Integrity protection

Parameters are submitted directly to the server over a backchannel connection before the redirect, so they cannot be tampered with in transit.

No URL length limits

Complex requests with many parameters, such as those using rich claims or acr_values, are no longer constrained by browser URL length limits.