# RFC9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)

This section contains the generic implementation of RFC9101.

This specification describe how to pass the authorization request payload in a JWT (called request object) instead of directly instead of GET or POST params.

The request object can either be passed directly in a `request` parameter, or be hosted by the client and be passed by reference with a `request_uri` parameter.

This usage is more secure than passing the request payload directly in the request, read the RFC to know all the details.

Request objects are optional, unless it is enforced by clients with the `require_signed_request_object` client metadata, or server-wide with the `require_signed_request_object` server metadata.

## API Reference

class authlib.oauth2.rfc9101.JWTAuthenticationRequest(support_request: bool = True, support_request_uri: bool = True)

  Authorization server extension implementing the support for JWT secured authentication request, as defined in RFC9101.

  Parameters:

    - support_request – Whether to enable support for the `request` parameter.

    - support_request_uri – Whether to enable support for the `request_uri` parameter.

  This extension is intended to be inherited and registered into the authorization server:

      class JWTAuthenticationRequest(rfc9101.JWTAuthenticationRequest):
          def resolve_client_public_key(self, client: ClientMixin):
              return get_jwks_for_client(client)

          def get_request_object(self, request_uri: str):
              try:
                  return requests.get(request_uri).text
              except requests.Exception:
                  return None

          def get_server_metadata(self):
              return {
                  "issuer": ...,
                  "authorization_endpoint": ...,
                  "require_signed_request_object": ...,
              }

          def get_client_require_signed_request_object(self, client: ClientMixin):
              return client.require_signed_request_object

      authorization_server.register_extension(JWTAuthenticationRequest())

  get_request_object_signing_algorithms(client)

    Return the supported algorithms for verifying the `request_object` JWT signature. By default, this method will only return the recommended algorithms. If signed request object is not required, “none” algorithm will be included.

    Developers can override this method to customize the supported algorithms:

        def get_request_object_signing_algorithms(self, client):
            return ["RS256"]

  get_request_object(request_uri: str)

    Download the request object at `request_uri`.

    This method must be implemented if the `request_uri` parameter is supported:

        class JWTAuthenticationRequest(rfc9101.JWTAuthenticationRequest):
            def get_request_object(self, request_uri: str):
                try:
                    return requests.get(request_uri).text
                except requests.Exception:
                    return None

  resolve_client_public_key(client: ClientMixin)

    Resolve the client public key for verifying the JWT signature. A client may have many public keys, in this case, we can retrieve it via `kid` value in headers. Developers MUST implement this method:

        from joserfc import KeySet

        class JWTAuthenticationRequest(rfc9101.JWTAuthenticationRequest):
            def resolve_client_public_key(self, client):
                if client.jwks_uri:
                    data = requests.get(client.jwks_uri).json()
                    return KeySet.import_key_set(data)

                return KeySet.import_key_set(client.jwks)

  get_server_metadata() → dict

    Return server metadata which includes supported grant types, response types and etc.

    When the `require_signed_request_object` claim is `True`, all clients require that authorization requests use request objects, and an error will be returned when the authorization request payload is passed in the request body or query string:

        class JWTAuthenticationRequest(rfc9101.JWTAuthenticationRequest):
            def get_server_metadata(self):
                return {
                    "issuer": ...,
                    "authorization_endpoint": ...,
                    "require_signed_request_object": ...,
                    "request_object_signing_alg_values_supported": ["RS256", ...],
                }

  get_client_require_signed_request_object(client: ClientMixin) → bool

    Return the ‘require_signed_request_object’ client metadata.

    When `True`, the client requires that authorization requests use request objects, and an error will be returned when the authorization request payload is passed in the request body or query string:

        class JWTAuthenticationRequest(rfc9101.JWTAuthenticationRequest):
            def get_client_require_signed_request_object(self, client):
                return client.require_signed_request_object

    If not implemented, the value is considered as `False`.

class authlib.oauth2.rfc9101.ClientMetadataClaims(claims: dict[str, Any], header: dict[str, Any], options: dict[str, ClaimsOption] | None = None, params: dict[str, Any] = None)

  Additional client metadata can be used with RFC7591: OAuth 2.0 Dynamic Client Registration Protocol and RFC7592: OAuth 2.0 Dynamic Client Registration Management Protocol endpoints.

  This can be used with:

      server.register_endpoint(
          ClientRegistrationEndpoint(
              claims_classes=[
                  rfc7591.ClientMetadataClaims,
                  rfc9101.ClientMetadataClaims,
              ]
          )
      )

      server.register_endpoint(
          ClientRegistrationEndpoint(
              claims_classes=[
                  rfc7591.ClientMetadataClaims,
                  rfc9101.ClientMetadataClaims,
              ]
          )
      )

class authlib.oauth2.rfc9101.AuthorizationServerMetadata

  Authorization Server Metadata extension for RFC9101 (JAR).

  This class can be used with `validate()` to validate JAR-specific metadata:

      from authlib.oauth2 import rfc8414, rfc9101

      metadata = rfc8414.AuthorizationServerMetadata(data)
      metadata.validate(metadata_classes=[rfc9101.AuthorizationServerMetadata])

  validate_require_signed_request_object()

    Indicates where authorization request needs to be protected as Request Object and provided through either request or request_uri parameter.