RFC 9700: Best Current Practice for OAuth 2.0 Security

This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750,…

Read RFC 9700 on the RFC Editor

Outgoing relationships (22 related RFCs)

Updates, Normative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Updates, Normative reference — RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
Updates, Normative reference — RFC 6819: OAuth 2.0 Threat Model and Security Considerations
Normative reference — RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
Normative reference — RFC 8414: OAuth 2.0 Authorization Server Metadata
Normative reference — RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
Normative reference — RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
Normative reference — RFC 7521: Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants
Normative reference — RFC 8252: OAuth 2.0 for Native Apps
Normative reference — RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
Informative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Informative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Informative reference — RFC 9110: HTTP Semantics
Informative reference — RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol
Informative reference — RFC 8707: Resource Indicators for OAuth 2.0
Informative reference — RFC 7636: Proof Key for Code Exchange by OAuth Public Clients
Informative reference — RFC 9101: The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)
Informative reference — RFC 9126: OAuth 2.0 Pushed Authorization Requests
Informative reference — RFC 9440: Client-Cert HTTP Header Field
Informative reference — RFC 9396: OAuth 2.0 Rich Authorization Requests
Informative reference — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Informative reference — RFC 9207: OAuth 2.0 Authorization Server Issuer Identification

Incoming relationships (2 related RFCs)

Normatively referenced by — RFC 9701: JSON Web Token (JWT) Response for OAuth Token Introspection
Informatively referenced by — RFC 9728: OAuth 2.0 Protected Resource Metadata