IETF OAuth · Guidance
Best Current Practice for OAuth 2.0 Security
The updated threat model and security advice for OAuth 2.0 deployments: audience restriction, PKCE everywhere, no token passthrough, deprecated flows.
PublishedBest Current Practice (BCP 240); updates RFC 6749, RFC 6750 and RFC 6819Canonical documentrfc9700
Revisions
- rfccurrent
Relations 2
Best Current Practice for OAuth 2.0 Security builds on 1
- The OAuth 2.0 Authorization FrameworkpublishedUpdates the framework's security considerations and deprecates the implicit grant and password grant.Source
Best Current Practice for OAuth 2.0 Security is built on by 1
- The OAuth 2.1 Authorization FrameworkWG draftFolds the security best current practice into the base specification.Source
Defines in the shared model
No features of this document are recorded yet. Features are what the atlases observe and the explorer cites; they are added as the products need them.