GNAP (Grant Negotiation and Authorization Protocol)
GNAP, the Grant Negotiation and Authorization Protocol (RFC 9635, Proposed Standard, October 2024), is an IETF delegated authorization protocol designed as a clean-slate successor to OAuth 2.0, in which a client negotiates a grant with an authorization server through a single JSON request that can describe rich access, several interaction modes, and key-bound tokens.
GNAP folds into one protocol several things OAuth needed extensions for: structured access requests similar to RAR, key-bound tokens by default, and interaction that can start on one device and finish on another. It is not compatible with OAuth, which is its main obstacle: client libraries, authorization servers, and API gateways all speak OAuth 2.0 and are moving to OAuth 2.1, while production GNAP deployments are uncommon. Read it for the design ideas, several of which (rich authorization, sender-constrained tokens) are now standard OAuth practice through RFC 9396 and DPoP, and choose OAuth for production unless you control both ends.
See also: OAuth, rich authorization requests, proof of possession, DPoP, OAuth 2.1, Justin Richer
Related on Start with Identity
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.