Most OAuth tutorials stop once login works.
But in a normal authorization code flow, client_id, scope, redirect_uri, state, and nonce can end up in the browser URL, logs, and history.
I wrote a hands-on tutorial showing how to use PAR with Quarkus OIDC and Keycloak to push that request over a back-channel instead.
https://www.the-main-thread.com/p/par-quarkus-oidc-keycloak-pushed-authorization-requests









