Client as resource owner
23An API can confuse a client identity with a user identity when both occupy the same identifier namespace.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.15 ↗
RFC 9700 · § 4.15DEFENSE
3 / 3
03
Enforce the correct principal’s permissions.
A client identity does not become a user identity through a matching string.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6749 § 4.4RFC 9700 § 4.15
The BCP adds defenses against confusing client-only token subjects with resource-owner identities.
Read the updated RFC section ↗Keep application and user identities distinct.
- Where client IDs and user identifiers share a namespace, servers SHOULD NOT let clients choose claims that collide with real users.
- If that influence cannot be avoided, the authorization server MUST provide other means to distinguish client-only tokens from user-involved tokens.
- Resource authorization must respect which kind of principal a token represents.
In a client-credentials grant, sub can represent the application. In a user-involved grant, sub can represent the resource owner. The same raw string must not accidentally confer the same authority.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
PrivacyAll chapters in this RFC
- OAuth overview
- Authorization code + PKCE
- Retire unsafe grants
- Prevent token replay
- Limit token privileges
- Authenticate the client
- Metadata, TLS & CORS
- The attacker model
- Redirect URI validation
- Referer header leakage
- Browser history leakage
- Authorization server mix-up
- Authorization code injection
- Access token injection
- Cross-site request forgery
- PKCE downgrade
- Leakage at resource servers
- Misuse of stolen tokens
- Open redirection
- 307 credential forwarding
- TLS termination & proxies
- Refresh token protection
- Client as resource owner
- Clickjacking
- In-browser messaging