See what a browser-carried authorization request exposes

Setup

1. In the tenant portal, open OAuth > Scopes and confirm that photos.read, prints.create and photos.delete exist. If they do not, reset the lab tenant with the Lab Photos preset.

2. Open OAuth > Clients and find lab-printer. If it does not exist yet, create it with the Web application preset: confidential, grants authorization_code and refresh_token, PKCE required, redirect URI http://127.0.0.1:8765/callback.

3. On lab-printer, set the consent mode to always, turn on Restrict scopes, and allow openid, profile, photos.read and prints.create. Leave photos.delete off. Save.

4. Make sure Ava can sign in: in Users, set a password for [email protected] if she has none.

5. In a terminal, set the shell variables. Read the secret without echoing it.

export ISSUER=https://tenant-<id>.beyondthelogin.dev   # from the tenant Overview
export CLIENT_ID=<lab-printer client_id>
read -rs CLIENT_SECRET; export CLIENT_SECRET
export REDIRECT=http://127.0.0.1:8765/callback
urlenc() { jq -rn --arg v "$1" '$v|@uri'; }

6. In a second terminal, start the loopback listener with btl-lab callback. It prints code, state, iss or an error, then exits; start it again before each attempt. If you have no terminal handy, add https://beyondthelogin.dev/lab/callback/ as a redirect URI on lab-printer and use that instead.

Walkthrough

1. Build an ordinary authorization request and measure it.

btl-lab pkce     # export the printed VERIFIER and CHALLENGE
btl-lab state    # export the printed STATE
URL="$ISSUER/oauth/authorize?response_type=code&client_id=$CLIENT_ID&redirect_uri=$(urlenc $REDIRECT)&scope=$(urlenc 'openid photos.read')&state=$STATE&code_challenge=$CHALLENGE&code_challenge_method=S256"
echo "$URL"; printf %s "$URL" | wc -c

Open the URL in a private window and sign in as Ava. Stop at the consent screen, which names the printer and photos.read. Now open the window's history: the whole request, scope, return address, state and challenge, is stored there.

Why it matters: this is "A request in plain sight". Every parameter travels in the address bar and is recorded wherever URLs are recorded.

2. In the address bar, change scope to openid photos.read prints.create (encode the spaces as %20) and press Enter. The consent screen now asks for both scopes.

Why it matters: this is "A request anyone can change". Both scopes are registered for the client, so the tenant cannot tell an edited request from one the printer built.

3. Edit the address again so scope also contains photos.delete, which the client may not request. The listener prints error=invalid_scope with your state and iss.

Why it matters: registration checks still limit an edit to what the client may request, exactly as the lesson says. Within those limits, the tenant cannot know which values the client chose.

4. Change redirect_uri to an address that is not registered, such as https://printer.example/oauth/callback. The tenant shows its own error page and sends nothing to the listener.

Why it matters: the tenant may not redirect to an address it cannot trust, so a mistake in the return address is invisible to the client.

5. Build a second request by hand in a new shell, with no client application involved: run btl-lab pkce and btl-lab state again, rebuild the URL, open it and approve as Ava. The listener prints a valid code.

Why it matters: the consent screen showed the printer's name for a request no printer software built. The tenant cannot know who wrote a browser-carried request.

6. Redeem that code. This is the first point in the flow where the client authenticates.

curl -s -u "$CLIENT_ID:$CLIENT_SECRET" "$ISSUER/oauth/token" -d grant_type=authorization_code \
  -d code=<code> --data-urlencode redirect_uri=$REDIRECT -d code_verifier=$VERIFIER | jq '{token_type, scope, expires_in}'

Why it matters: this is "Checks that come too late". Sign-in and consent happened before the tenant knew which client was really asking.

7. Open Audit in the tenant portal and filter to oauth.authorize and oauth.token for lab-printer. Put the events from steps 5 and 6 in order: request_started, then the sign-in and consent, then code_issued with no client credential involved, and only then oauth.token succeeded with the client as actor.

Why it matters: the tenant's own evidence shows the person was asked to approve before any client authentication took place.

Planned walkthrough

Once the tenant has a PAR endpoint (G11), finish the lab with the fix the lesson describes in "Sending the request directly".

1. Push the step 1 parameters from the back end, authenticated like a token request.

curl -s -u "$CLIENT_ID:$CLIENT_SECRET" "$ISSUER/oauth/par" \
  -d response_type=code -d client_id=$CLIENT_ID --data-urlencode redirect_uri=$REDIRECT \
  --data-urlencode "scope=openid photos.read" -d state=$STATE \
  -d code_challenge=$CHALLENGE -d code_challenge_method=S256 | jq .

Expect 201 with a request_uri and expires_in.

2. Open $ISSUER/oauth/authorize?client_id=$CLIENT_ID&request_uri=<url-encoded request_uri>. The address bar holds no scope to edit.

3. Push again with a wrong secret. Expect 401 invalid_client before Ava sees any page. Compare this with Break it below.

The next three labs carry the full PAR walkthrough.

Break it

1. Run steps 1 and 5 again to get a fresh code, then redeem it with a wrong secret.

read -rs WRONG_SECRET
curl -s -u "$CLIENT_ID:$WRONG_SECRET" "$ISSUER/oauth/token" -d grant_type=authorization_code \
  -d code=<code> --data-urlencode redirect_uri=$REDIRECT -d code_verifier=$VERIFIER | jq .
unset WRONG_SECRET

The answer is 401 {"error":"invalid_client",...}, and Audit records oauth.token rejected invalid_client, after Ava had already signed in and approved. This is the late failure that PAR moves to the front.

Check your work

Press Check my progress. The checks look for, in order:

• oauth.authorize rejected invalid_scope for lab-printer (step 3)

• oauth.authorize succeeded code_issued (step 5)

• oauth.token succeeded for lab-printer (step 6)

• oauth.token rejected invalid_client for lab-printer (Break it)

Cleanup

1. Revoke the access token from step 6.

curl -s -u "$CLIENT_ID:$CLIENT_SECRET" "$ISSUER/oauth/revoke" -d token=<access_token>

2. Clear the private window's history and stop the listener.

3. Set lab-printer's consent mode back to remember if you prefer fewer consent screens in later labs.

Missing infrastructure

• G11: there is no PAR endpoint yet. POST $ISSUER/oauth/par answers 501 and discovery has no pushed_authorization_request_endpoint. Once it exists, the Planned walkthrough runs as written: the scope edit has nothing to edit, and a wrong secret fails at the push before anyone sees a page.