Mastering OAuth2 Client Authentication: From client_secret_jwt to TLS Methods

OAuth2 clients are classified as Confidential or Public based on their ability to securely authenticate with the authorization server. Confidential clients have a password credential, while public clients (e.g., browser or mobile apps) do not, but all have a client_id.

OAuth2 Client Authentication

During sensitive OAuth2 flows (token request, introspection, revocation), the client must authenticate with the authorization server to prevent interception.

Client Authentication Methods

Current methods include client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, and self_signed_tls_client_auth.

Older demos used POST; Spring Authorization Server demos use client_secret_basic. The most widely used modern methods are client_secret_jwt and private_key_jwt, which protect credentials more securely and are supported by Spring Security.

client_secret_jwt

The client uses its secret as an HmacSHA256 key to generate a SecretKey, then creates a JWT containing client information, which is sent in the token request.

byte[] pin = clientSecret.getBytes(StandardCharsets.UTF_8);
SecretKeySpec secretKey = new SecretKeySpec(pin, "HmacSHA256");

The token request includes the JWT as client_assertion:

POST /oauth2/token HTTP/1.1
Host: oauth2_client.felord.cn
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
code=n0esc3NRze7LTCu7iYzS6a5acc3f0ogp4&
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&
client_assertion=YOUR_JWT

The authorization server validates the JWT using the client_secret, allowing secure transmission even without HTTPS.

private_key_jwt

This method generates the JWT using an RSA or EC private key instead of a client_secret. The client also provides a jwkSetUrl so the server can obtain the public key. It eliminates the need for a client_secret and offers stronger security.

tls_client_auth

Authentication is performed at the TLS layer using certificates issued by a trusted CA, making it a non‑intrusive, application‑layer‑independent method.

self_signed_tls_client_auth

Similar to tls_client_auth but uses a self‑signed X.509 certificate.

Summary

Many tutorials only cover outdated POST methods and client_secret_basic/post. The newer methods—client_secret_jwt, private_key_jwt, tls_client_auth, and self_signed_tls_client_auth—offer distinct security advantages, and you can choose the appropriate one based on your threat model.