vigiloauth/vigilo

Support RequestURI during client authorization

Open

#345 opened on May 27, 2025

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Go (9 forks)auto 404
good first issuepriority: medium

Repository metrics

Stars
 (100 stars)
PR merge metrics
 (PR metrics pending)

Description

Description Add support for the OAuth 2.0/OpenID Connect request_uri parameter to allow clients to pass a URI referencing a signed request object during authorization. This enables improved security and flexibility by offloading large request parameters from the authorization request itself.

User Story: As a client application developer, I want to use the request_uri parameter during authorization requests, So that I can securely reference pre-registered request objects without sending all parameters directly.

Acceptance Criteria:

  • Implement support for request_uri as defined in OAuth 2.0 and OpenID Connect specifications.
  • Validate and fetch the request object from the provided URI.
  • Verify signatures and integrity of the request object.
  • Integrate the request object parameters into the authorization flow seamlessly.
  • Handle errors gracefully if the request URI is invalid or inaccessible.
  • Document usage of request_uri support for client developers.

Contributor guide

Research direction
Review the OAuth 2.0 and OpenID Connect specifications for the request uri parameter. Study the existing authorization request handler to understand where to integrate. Implement fetching the request object from the URI, validate its signature and integrity, merge parameters into the authorization flow, and handle errors appropriately.
Tech stack
go
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoOAuth 2.0/OpenID Connect knowledge
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50