RFC 9207 — Issuer Identification — Versola Docs
VersolaVersola/docs
Pre-1.00.7.1versola.kzGitHub
RUEN

RFC 9207 — Issuer Identification

The iss parameter in authorization responses, which protects clients that talk to several authorization servers from mix-up attacks.

Specification: RFC 9207

RFC 9207 adds the issuer identifier to the authorization response so that a client can check which server the response came from. FAPI 2.0 requires it.

Status

Implemented. Checked claims: 4 of 5.

Authorization response

  • iss parameter on a successful authorization response, next to code and state (§2)
  • iss parameter on an error response, including errors returned in the fragment
  • Under JARM the issuer is the iss claim of the signed response JWT, and is not repeated as a bare parameter

Authorization server metadata

  • authorization_response_iss_parameter_supported: true in the generated discovery document (§3)
  • Derived from behaviour — the field comes from the stored discovery document, so an operator can remove it while auth still sends iss

Notes

  • The value is the configured issuer, the same string as issuer in discovery.
  • Clients must compare iss with the issuer they started the request with; auth cannot do that for them.

Where to look

The OpenAPI reference has the authorize and metadata specifications.