Justin Richer
- Co-author of 'OAuth 2 in Action' (Manning, 2017)
- Editor and primary author of GNAP (Grant Negotiation and Authorization Protocol)
Bio
Justin Richer is one of the most active OAuth working group contributors. He led the design of GNAP, the IETF effort to design a next-generation authorization protocol intended to address structural limits of OAuth 2.0. Co-author of the standard-reference book on OAuth.
Profile built from public IETF records and published works.
Where their work shows up
Richer's GNAP work is the most serious attempt to redesign authorization beyond the structural limits of OAuth 2.0, particularly around delegation across more than two parties. That problem is now urgent for agentic identity, where an agent acts for a user across several systems and the audit question becomes a chain rather than a call.
Podcasts
Related on Start with Identity
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still