Put the note in the right pocket
02The token endpoint reads named form fields. A correct signature cannot repair a statement sent under the wrong name.
One form field has a name and a value.
Offline worked example. Only the public signature/MAC fixtures receive real local cryptographic checks. Other trust, grant, clock and permission inputs are selected teaching cases.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
A well-packed form has not yet passed signature, names or time checks.
Key idea: Field names decide what the statement is being used for.
Terms
- assertion
- A statement another system can check; here it is carried as a JWT.
- authorization grant
- Evidence supporting a request for an access token.
- client authentication
- Checking which app made the request.
- token endpoint
- The server address where an app requests tokens.
- JWT
- JSON Web Token: a compact container for named statements.
- issuer
- The system that created the statement.
- subject
- Who or what the statement is about.
- audience
- The intended receiver of the statement.
- claim
- A named piece of information inside the JWT.
- signature
- A checkable result over bytes made with a secret signing key.
- MAC
- A check over bytes made with a key shared by the parties.
- RS256
- A secret signing key makes a checkable signature; a matching shareable key checks it.
- HS256
- A shared secret lets either party make and check a result over the bytes.
- exp
- Required ending time for using this JWT.
- nbf
- Optional time before which this JWT must not be accepted.
- iat
- Optional time when the JWT was issued.
- jti
- Optional identifier for this JWT; a server may remember it to detect reuse.
- scope
- The named permission requested, such as reading pictures.
- bearer assertion
- A statement usable by someone who possesses it, without proving possession of a separate signing key on each request.
Rules & examples
Field names decide what the statement is being used for.
These reference examples may differ from the selected experiment.
- Use application/x-www-form-urlencoded. JWT grants use grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion containing one JWT. Client authentication uses client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer and client_assertion containing one JWT, alongside a grant. Parameter names and values are case sensitive unless stated otherwise.
Bounded offline examples; crypto fixtures are separate from the selected trust and permission policy.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.