According to RFC 9101 §6.3 the authorization server MUST only use the parameters in the Request Object. In the current implementation an error is returned if the supplied query parameters differ, but that should only be the case for client_id.
I believe that the implementation instead should replace the Raw values in ValidatedAuthorizeRequest with the value from the request object and simply ignore the value from the query string. Values that are only present in the query string (could be nonce and state for example) should still be used if they does not exists in the request ojbect.
There is a test JwtRequestAuthorizeTests.mismatch_in_jwt_values_should_error that verifies the current behavior.
According to RFC 9101 §6.3 the authorization server MUST only use the parameters in the Request Object. In the current implementation an error is returned if the supplied query parameters differ, but that should only be the case for client_id.
I believe that the implementation instead should replace the Raw values in ValidatedAuthorizeRequest with the value from the request object and simply ignore the value from the query string. Values that are only present in the query string (could be nonce and state for example) should still be used if they does not exists in the request ojbect.
There is a test JwtRequestAuthorizeTests.mismatch_in_jwt_values_should_error that verifies the current behavior.