Lion Cipher Lab
Implement OAuth 2.0 Rich Authorization Requests (RAR, RFC 9396) — fine-grained authorization from scratch
- Identity & Access Management
- Advanced
- ~45 min
- Free · no account required
Why it matters
Classic OAuth scopes are flat strings: "payments" is one boolean — either the token can move money or it cannot. It cannot say "transfer at most 50 EUR, once, to this one account." That gap is exactly where high-value and regulated flows (open banking, FAPI, payments) get burned: a token stolen or over-scoped can do anything the coarse scope allows. RFC 9396 Rich Authorization Requests fixes this by carrying a structured, typed grant the resource server enforces per request. Building the AS and RS yourself — and watching one token be accepted for 45 EUR and rejected for 500 — turns…
What you'll learn
- OAuth 2.0 Rich Authorization Requests (RFC 9396)
- the authorization_details parameter and typed authorization objects
- building a minimal authorization server and resource server
- per-request authorization enforcement
- fine-grained vs scope-based access control
- token-security threat modelling
Steps in this lab
- Why a boolean scope is not enough
- Make a folder and open a terminal
- Build the AS + RS in one file
- Start the server
- Request a token carrying authorization_details
- One token, four verdicts — prove the win
- Enforcement is the product — the named failure modes
- Judgment — scopes vs RAR: when each is right