Repository navigation
Update typ Header Parameter to support RFC 9068's validating access token recommendations #19419
JonSzeto821
started this conversation in
Ideas
Replies: 1 comment
|
Hi @JonSzeto821 |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello,
My team is currently working towards standardizing JWT tokens and the information encapsulated within them for RHSSO/Keycloak. We came across RFC 9068 and the proposed approach for validating JWT access tokens (RFC 9068 section 4). Keycloak's access token validation meets five of the six criteria suggested in RFC 9068. The validation that is currently missing is:
To get Keycloak more aligned with the standards proposed by IETF, we would like to recommend the following change:
typHeader Parameter value toat+jwtfor access tokenstypHeader Parameter on access tokens isJWTapplication/at+jwt, is not being considered due to this RFC 7515: https://www.rfc-editor.org/rfc/rfc7515#section-4.1.9Looking through past discussions, there appears to be support for being aligned with RFC 9068 here: #8646
cc: @jsorah
All reactions