A presentation given by Michal Trojanowski, Product Marketing Engineer, Curity, at our 2023 Platform Summit, October 17-18, 2023

1. Military-Grade Security for APIs
Michał Trojanowski
Product Marketing Engineer @ Curity

2. • Who is it for?
• mTLS
•Sender-constrained access tokens
• PAR
•JARM
Agenda

3. Who Needs Secure APIs?
Finance Medical Sensitive data

4. mTLS

5. TLS
Client Server

6. mTLS = mutual TLS
Client Server

7. Sender-constrained tokens

8. Sender-constrained tokens
Bearer tokens
Sender-constrained tokens /
Proof-of-Possession tokens

9. Bearer tokens
Client 2
API
API
Gateway
Client 1

10. Proof-of-Possession tokens
Client 2
API
API
Gateway
Client 1
Client 3

11. Proof-of-Possession for JWTs
• Standard defined in RFC 7800.
• Adds a “cnf” (confirmation) claim to the token, which enables
the recipient to verify the caller.

12. PoP JWTs with “cnf” claim
Client
API
API
Gateway
Authorization
Server
public key
private key
+ proof of
{
“cnf”: {
“kid”: “1234”
}
}
+ proof of

13. PAR

14. Pushed Authorization Requests
•Standard defined in RFC 9126.
•Provides means for confidential and integrity-protected
authorization requests.

15. HTTP 400
Standard OAuth Authorization Requests
GET /authorize?client_id=abc&scopes=read%20write
HTTP 302
Location: /cb?code=123
Is that a legitimate client?
Are the parameters OK?
Can these end up in the browser logs?
Client Authorization
Server

16. Pushed Authorization Requests
POST /authorize/par
Authorization: Basic 0JjQlNCYOtCd0JDQpdCj0Jkh
client_id=abc&scopes=read%20write
request_id: 1234
GET /authorize?request_id=1234
Client Authorization
Server

17. Pushed Authorization Requests
• The client is authenticated before the authorization request.
• Authorization request parameters can’t be tampered with.
• Request parameters do not traverse through unsecure transport.
• URL limitations are no longer a concern.
• Ability to ease on redirect URI restrictions.

18. JARM

19. JWT Secured Authorization Response Mode
•A specification from the OpenID Foundation.
•Protects against attacks on the authorization code response.

20. Standard Response
GET /authorize?client_id=abc&scopes=read%20write…
HTTP 302
Location: https://example.com/cb?code=abcdef&state=1234
Was it issued by the correct Authorization Server?
Does this code belong to this state?
Client Authorization
Server

21. JWT Secured Response
GET /authorize?client_id=abc&scopes=read%20write…
HTTP 302
Location: https://example.com/cb?response=eyJhbGciOiJSUzN…
decode &
verify
{
iss: https://idsvr.example.com ,
code: “abcdef”,
state: “12345”,
…
}
Client Authorization
Server

22. JWT Secured Authorization Response Mode
• Supports all the usual response modes:
• query.jwt
• fragment.jwt
• form_post.jwt
• jwt

23. JWT Secured Authorization Response Mode
•The code response is integrity-protected.
•Response parameters strongly coupled (mitigates replay attacks).
•Protection from mix-up attacks (ability to verify iss claim).

24. Key Takeways
• Struggle to use mTLS wherever that’s possible.
• Remember sender-constrained access tokens if stealing the token is what
troubles you.
• Give PAR and JARM a try if you’re concerned with some attack vectors against
authorization requests and responses.
• Don’t discard security solutions because you’re in a different business sector.

25. Thank You!
curity.io
developer.curity.io
@curityio
info@curity.io