2026-09-22 · 8 min read
- oauth
- security
- authorization
Pushed Authorization Requests move authorization parameters from a browser-facing authorization URL to a direct request from the client to the authorization server. After accepting the parameters, the server returns a request_uri handle and a lifetime for a later authorization request.
PAR can improve request integrity and keep large or sensitive parameters out of browser URLs, but it does not remove redirect URI validation, CSRF correlation, PKCE, client authentication, or authorization-server policy.
Establish a trusted back channel
Discover the PAR endpoint from metadata bound to the expected issuer or configure it directly through trusted deployment settings. Apply HTTPS validation, outbound destination controls, timeouts, response-size limits, and redirect policy.
- Use the registered client authentication method.
- Send parameters with the required media type and encoding.
- Keep credentials and assertion keys out of logs.
- Do not accept endpoint locations from browser input.
Build one authoritative parameter set
Construct redirect URI, response type, scope, state, PKCE challenge, nonce, resources, authorization details, and any request object from one transaction record. Apply duplicate-parameter and request-object precedence rules from the selected profile.
Treat PAR rejection as a protocol result with a bounded retry policy. Do not repeatedly submit invalid requests or weaken registered redirect, signing, encryption, and client-authentication requirements to make one provider integration pass.
Bind and expire the returned handle
Preserve request_uri exactly and associate it with the same client-side browser transaction that owns state, nonce, and the PKCE verifier. At the authorization endpoint, send the client identifier and handle as required without copying changed parameters beside it.
Honor the returned lifetime with a small operational margin. Define behavior for retries, browser back navigation, cancellation, reuse, multiple tabs, node failover, and clock disagreement without exposing live handles in analytics or support artifacts.
Exercise protocol and deployment failures
Use Flashman's URL tool for public callback fixtures, JWT decoder for disposable request objects, JSON formatter for sanitized metadata, diff for parameter sets, and timestamp converter for expiry timelines.
Test each client authentication method, exact redirect matching, PKCE, signed request objects, duplicate and conflicting parameters, unknown or expired handles, reuse, issuer confusion, endpoint rotation, network timeout, safe retry, multi-node correlation, browser cancellation, and callback validation.