Enable PAR by default when it is supported by the provider

Author: josephdecock

clients/ConsoleClientWithBrowser/Program.cs

@@ -47,8 +47,6 @@ private static async Task SignIn()
                 Browser = browser,
                 IdentityTokenValidator = new JwtHandlerIdentityTokenValidator(),
                 RefreshTokenInnerHttpHandler = new SocketsHttpHandler(),
-
-                UsePushedAuthorization = true
             };
 
             var serilog = new LoggerConfiguration()

clients/ConsoleClientWithBrowserAndDPoP/Program.cs

@@ -47,8 +47,7 @@ private static async Task SignIn()
                 RedirectUri = redirectUri,
                 Scope = "openid profile api offline_access",
                 FilterClaims = false,
-                Browser = browser,
-                UsePushedAuthorization = true
+                Browser = browser
             };
 
             options.ConfigureDPoP(proofKey); 

src/OidcClient/AuthorizeClient.cs

@@ -105,8 +105,10 @@ public async Task<AuthorizeState> CreateAuthorizeStateAsync(Parameters frontChan
                 CodeVerifier = pkce.CodeVerifier,
             };
 
-            if(_options.UsePushedAuthorization)
+            if(_options.ProviderInformation.PushedAuthorizationRequestEndpoint.IsPresent() &&
+                !_options.DisablePushedAuthorization)
             {
+                _logger.LogDebug("The IdentityProvider contains a pushed authorization request endpoint. Automatically pushing authorization parameters. Use DisablePushedAuthorization to opt out.");
                 var parResponse = await PushAuthorizationRequestAsync(state.State, pkce.CodeChallenge, frontChannelParameters);
                 if(parResponse.IsError)
                 {

src/OidcClient/OidcClientOptions.cs

@@ -245,8 +245,10 @@ public class OidcClientOptions
         };
 
         /// <summary>
-        /// Gets or sets a flag to enable Pushed Authorization Requests (PAR).
+        /// Gets or sets a flag to disable Pushed Authorization Requests (PAR).
+        /// By default, we use PAR when there is a configured PAR endpoint or
+        /// when the discovery endpoint indicates that it supports PAR.
         /// </summary>
-        public bool UsePushedAuthorization { get; set; }
+        public bool DisablePushedAuthorization { get; set; } = false;
     }
 }