Package rfc9207

import "funnyhaha.technology/rfc/rfc9207"

Overview

Package rfc9207 implements the authorization server issuer identification of RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification): the iss parameter in authorization responses, which lets a client that uses several authorization servers detect a mix-up attack.

OAuth 2.1 makes iss required in every authorization response, and its package, oauth21draft, sends it. A server says so in its metadata:

md = md.WithExtension(rfc9207.MetadataSupported, true)

and a client checks each response it receives before using it:

err := rfc9207.Check(redirect.Query(), metadata.Issuer, true)

The RFC text is in rfc9207.txt in this directory, and the doc comments cite its sections.

Index

• Constants
• Variables
• func Check

Constants

const MetadataSupported = "authorization_response_iss_parameter_supported"

const Param = "iss"

Variables

var (
	// ErrIssuerMismatch is returned by [Check] for a response whose iss
	// isn't the expected issuer.
	ErrIssuerMismatch = errors.New("authorization response issuer mismatch")

	// ErrMissingIssuer is returned by [Check] for a response without iss
	// from a server that supports it.
	ErrMissingIssuer = errors.New("authorization response has no issuer")
)

Functions

Check source

func Check(query url.Values, issuer string, supported bool) error

Check validates the iss parameter of an authorization response, success or error, as a client must before using it (Section 2.4). The query is the redirect's decoded query, and issuer is the issuer identifier from the server's metadata, compared by simple string comparison.

It returns ErrIssuerMismatch if iss is present and differs, and ErrMissingIssuer if it's absent and supported is true, which the server's metadata says with MetadataSupported. A response without iss from a server that doesn't support it passes.