Support Pushed Authorization Request

[nabokihms]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Problem Description

It is not secure enough to send auth params via GET params, because it persists in the browser and can be easily compromised and forged. Also, GET params can become large.

Proposed Solution

Implement PAR in Dex. A simple workflow is:

1. Accept post requests on /auth endpoint
2. Create an AuthRequest
3. Return the redirect URL with the auth request ID as a state
4. On redirect, check whether the state exists. If so, proceed.

Protect the state with HMAC.

Alternatives Considered

No response

Additional Information

https://datatracker.ietf.org/doc/html/rfc9126