-
Notifications
You must be signed in to change notification settings - Fork 36
Open
Description
Hello,
I am trying to understand Authorization Endpoint flows and the relationship between the Pushed Authorization Request (PAR) mechanism and the redirect_to_web interaction type.
From my understanding - PAR vs redirect to web
PARfocuses on making aPOSTto/parwhich responds withrequest_urito which Wallet is supposed to redirect for user authorizationredirect_to_webis an interaction instruction that focuses on Wallet performing initial interaction request and getting the response withrequest_urito which Wallet is expected to redirect for user authorization.
Functionally, both seem to result in the Wallet redirecting the user to a web-based authorization endpoint, which makes them appear similar from a Wallet UX perspective.
I wanted to check:
- Is this distinction (
PARvsredirect_to_webinteraction ) expected to remain separate? - Are there any discussions or plans to align or merge these concepts in future revisions, or is the current separation considered important for clarity and extensibility?
- I would also like to confirm the use of the
authorization_endpointas mentioned in RFC 6749 & RFC 8414 for obtaining anauthorization_code. Could this requirement change in the future? Is it always mandatory for an Issuer (Authorization Server) to support theauthorization_endpoint, even if it expects authorization to occur via user interaction (such as aninteractive_authorization_endpoint)? If so, are there specific scenarios—such as when amissing_interaction_typeerror is returned by the Issuer—where the Wallet may fall back to using theauthorization_endpointfor authorization?
Metadata
Metadata
Assignees
Labels
No labels