ISO/IEC 26138:2024 PDF

Name: ISO/IEC 26138:2024 — Information technology — OpenID connect — OAuth 2.0 multiple response type encoding practices
SKU: ISO/IEC 26138:2024
Price: 25 EUR
Availability: InStock

Information technology — OpenID connect — OAuth 2.0 multiple response type encoding practices

Название (английский):

ISO/IEC 26138:2024

Information technology — OpenID connect — OAuth 2.0 multiple response type encoding practices

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 11
Дата публикации:: 1 октября 2024 г.
Издание:: ISO/IEC IS 26138 edition 1 version 1
ICS:: 35.030

Тип поставки:

Full version165 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:2 раб. дн. (перевод)

Цена:165 €

Описание (английский):

This document provides guidance on the proper encoding of responses to OAuth 2.0 Authorization Requests in which the request uses a Response Type value that includes space characters. Furthermore, this document registers several new Response Type values in the OAuth Authorization Endpoint Response Types registry. This document also defines a Response Mode Authorization Request parameter that informs the Authorization Server of the mechanism to be used for returning Authorization Response parameters from the Authorization Endpoint.

Abstract

Похожие стандарты

Другие стандарты ISO

Overview

ISO/IEC 26138:2024 - "Information technology - OpenID Connect - OAuth 2.0 multiple response type encoding practices" provides formal guidance for how Authorization Servers and Clients should encode and return parameters for OAuth 2.0 / OpenID Connect Authorization Requests that use space-separated (multiple-valued) response_type values. Published as a JTC 1 PAS document and prepared by the OpenID Foundation, the standard clarifies encoding rules, registers several response types with IANA, and defines a new response_mode request parameter.

Key topics and technical requirements

Response Mode (response_mode): An optional Authorization Request parameter that specifies the mechanism used to return Authorization Response parameters (e.g., query vs fragment). The spec registers response_mode in the OAuth Parameters registry and advises not to send a response_mode value that duplicates the Response Type's default.

Default encodings:

code: default Response Mode is query encoding.
token: default Response Mode is fragment encoding.
id_token and multiple-valued combinations (e.g., id_token token, code id_token token) default to fragment encoding; the query encoding MUST NOT be used for these.
none: default Response Mode is query encoding and should not be combined with other Response Types.

Multiple-valued Response Types: When a response_type contains spaces it is treated as a set of values (order does not matter). The standard recommends returning all parameters using the same response mode (both success and error responses) to simplify client processing and reduce latency.

New / registered Response Types: The document registers several values in the IANA OAuth Authorization Endpoint Response Types registry (e.g., id_token, none, code token, code id_token, id_token token, code id_token token) and specifies their expected returned parameters.

Security considerations: The spec notes risks with query-string encoding (potential leakage) and explains why fragment encoding reduces exposure of sensitive tokens such as id_token.

Practical applications and intended users

Identity and access management engineers implementing OAuth 2.0 and OpenID Connect flows.

Authorization Server and Identity Provider (IdP) developers who must support multiple response types and correctly encode Authorization Responses.

Client application developers (SPAs, mobile apps, web apps) who parse authorization responses and must handle fragment vs query encodings.

Security architects and auditors assessing token leakage risks and ensuring correct registry usage.

Related standards

RFC 6749 (OAuth 2.0)

OpenID Connect specifications

IANA OAuth Authorization Endpoint Response Types registry and IANA OAuth Parameters registry

Keywords: ISO/IEC 26138:2024, OpenID Connect, OAuth 2.0, response_type, response_mode, id_token, fragment encoding, query encoding, multiple-valued response types, IANA registry.

ISO/IEC 26138:2024 PDF

Abstract

Похожие стандарты

Overview

Key topics and technical requirements

Practical applications and intended users

Related standards

Технические детали

ISO 8689-1:2000

Water quality — Biological classification of rivers — Part 1: Guidance on the interpretation of biological qu…

ISO/ASTM51540-04(2012)

Standard Practice for Use of a Radiochromic Liquid Dosimetry System (Withdrawn 2020)

ISO/ASTM51204-04

Standard Practice for Dosimetry in Gamma Irradiation Facilities for Food Processing (Withdrawn 2013)

ISO/ASTM51431-05

Standard Practice for Dosimetry in Electron Beam and X-Ray (Bremsstrahlung) Irradiation Facilities for Food P…

ISO/ASTM52628-20e1

Standard Practice for Dosimetry in Radiation Processing

ISO/ASTM52921-13(2019)

Standard Terminology for Additive Manufacturing—Coordinate Systems and Test Methodologies

ISO/ASTMTR52917-EB

Additive Manufacturing — Round Robin Testing — General Guidelines

ISO/ASTM52901-17(2023)

Standard Guide for Additive Manufacturing – General Principles – Requirements for Purchased AM Parts