{"version":"2.1.260","anchor":"new-rfc-8707-resource-indicator-field-for-gateway-oidc-infer","canonical_anchor":"new-rfc-8707-resource-indicator-field-for-gateway-oidc-infer","heading":"New RFC 8707 resource-indicator field for gateway OIDC inference auth","tier":"use","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/new-rfc-8707-resource-indicator-field-for-gateway-oidc-infer","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### New RFC 8707 resource-indicator field for gateway OIDC inference auth\n\nGateway OIDC auth can now send an RFC 8707 resource-indicator URL to audience-restrict tokens.\n\nGateway OIDC inference auth (access-token mode) supports a new `resource` subfield for setting an absolute HTTPS resource-indicator URL, sent on authorization, token, and refresh requests per RFC 8707. This lets the IdP audience-restrict the issued token to the gateway. It works with AD FS and other RFC 8707-compliant identity providers, but is explicitly not supported for Entra ID.\n\n- Area: Auth\n- Names: `resource`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 1\/5"}