RFC 7636: Proof Key for Code Exchange by OAuth Public Clients

OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes…

Read RFC 7636 on the RFC Editor

Outgoing relationships (9 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 5226: Guidelines for Writing an IANA Considerations Section in RFCs
Normative reference — RFC 5234: Augmented BNF for Syntax Specifications: ABNF
Normative reference — RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
Normative reference — RFC 4648: The Base16, Base32, and Base64 Data Encodings
Normative reference — RFC 20: ASCII format for network interchange
Normative reference — RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
Normative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Informative reference — RFC 6819: OAuth 2.0 Threat Model and Security Considerations

Incoming relationships (5 related RFCs)

Normatively referenced by — RFC 8252: OAuth 2.0 for Native Apps
Normatively referenced by — RFC 10027: Best Current Practice for Security of Cross-Device Flows
Informatively referenced by — RFC 9126: OAuth 2.0 Pushed Authorization Requests
Informatively referenced by — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Informatively referenced by — RFC 9700: Best Current Practice for OAuth 2.0 Security