François<p>You can use JWTs for client authentication with OAuth/OIDC, but it does NOT require you to specify the `client_id` POST parameter. So you are supposed to parse the complete JWT token _first_ before validating the signature to extract the `sub`, which is actually the `client_id` of the client/RP in order to find the set of keys that can verify the JWT that you just parsed and used unverified. What the hell.</p><p><a href="https://www.rfc-editor.org/rfc/rfc7523.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">rfc-editor.org/rfc/rfc7523.htm</span><span class="invisible">l</span></a></p><p><a href="https://floss.social/tags/jwt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>jwt</span></a> <a href="https://floss.social/tags/oauth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>oauth</span></a> <a href="https://floss.social/tags/openid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>openid</span></a> <a href="https://floss.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://floss.social/tags/fail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fail</span></a></p>