OAuth 2.0 Security Best Current Practice (RFC 9700)
- Category
- Auth and identity
- Docs outline
- 6 sections
Official docs outline
rfc-editor.org- Recommendations
Core security recommendations for authorization servers and clients.
- Protecting redirect-based flows
Exact redirect URI matching and avoiding open redirectors.
- Token replay prevention
Avoiding implicit grant and token leakage in referrer or logs.
- Access token privilege restriction
Audience restriction and sender-constrained tokens.
- Refresh token protection
Rotation and binding refresh tokens.
- Attacks and mitigations
Mix-up, CSRF, code injection and PKCE downgrade attacks.
Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.