Justin Richer
- Co-author of 'OAuth 2 in Action' (Manning, 2017)
- Editor and primary author of GNAP (Grant Negotiation and Authorization Protocol)
Bio
Justin Richer is one of the most active OAuth working group contributors. He led the design of GNAP, the IETF effort to design a next-generation authorization protocol intended to address structural limits of OAuth 2.0. Co-author of the standard-reference book on OAuth.
Profile built from public IETF records and published works.
Where their work shows up
Richer's GNAP work is the most serious attempt to redesign authorization beyond the structural limits of OAuth 2.0, particularly around delegation across more than two parties. That problem is now urgent for agentic identity, where an agent acts for a user across several systems and the audit question becomes a chain rather than a call.
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b