2026-09-23 · 8 min read
- oauth
- jwt
- security
JWT Secured Authorization Response Mode protects OAuth authorization response parameters in a signed JWT and can add encryption when the profile requires confidentiality. It gives a client stronger integrity and issuer binding than reading loose browser parameters alone.
JARM complements rather than replaces redirect URI registration, state correlation, PKCE, nonce handling where applicable, one-time authorization codes, token-endpoint authentication, and browser security.
Register one explicit response profile
Configure the expected response mode, signing algorithm, optional encryption algorithms, client keys, redirect URI, and issuer metadata through a trusted registration path. Do not negotiate weaker algorithms from values found only in the received JWT.
- Allowlist asymmetric signing algorithms.
- Bind discovery and JWKS to the expected issuer.
- Separate JARM keys from unrelated tenant keys.
- Plan overlap and cache behavior for rotation.
Validate before consuming parameters
Locate the response parameter in the registered query, fragment, or form-post mode. Decrypt if required, verify the signature, and validate issuer, audience, expiration, issued-at policy, and any profile-required identifier before reading code, state, or error.
Apply duplicate-parameter rules to the outer response and reject unexpected loose authorization parameters that could conflict with protected claims. Return a generic browser error while retaining a sanitized failure category for diagnostics.
Bind the browser transaction
Compare state using the transaction record created before redirect. Keep the PKCE verifier, expected issuer, nonce if used, redirect URI, and JARM policy in that same short-lived record. Consume the transaction exactly once.
Exchange a valid code only at the trusted token endpoint with the original redirect and verifier. A valid JARM response must not authorize code replay, cross-client use, mix-up between issuers, or repeated browser callbacks.
Publish protocol conformance cases
Use Flashman's JWT decoder for disposable structures, URL tool for callback fixtures, JSON formatter for sanitized metadata, timestamp converter for clock windows, and diff for registration changes. Use a reviewed OAuth library for cryptography.
Test signed and encrypted responses, success and protocol errors, wrong issuer or audience, missing or repeated state, algorithm rejection, malformed nesting, clock boundaries, duplicate outer parameters, key rotation, browser replay, mix-up attempts, and failed code exchange.