oauth.net
OAuth 2.0 Security Best Current Practice
The Security BCP updates and extends the original threat model (RFC 6819) with current best practices — reflecting years of real-world implementation experience and newly discovered attack vectors.
When to use this
This document applies to anyone implementing OAuth 2.0 — clients, authorization servers, and resource servers. Its key recommendations include: always use PKCE, use exact redirect URI matching, do not use the Implicit or Password grants, prefer PAR for high-security deployments, and use sender-constrained tokens (DPoP or mTLS) where possible.
RFC 9700 supersedes RFC 6819 and consolidates guidance that was previously spread across multiple documents. It formally deprecates the Implicit flow and Password grant, mandates PKCE for all authorization code flows, and introduces requirements for mix-up attack prevention. The recommendations in this document are incorporated into OAuth 2.1.
More resources
- Why you should stop using the OAuth implicit grant (Torsten Lodderstedt)
- What's New with OAuth and OpenID Connect — video by Aaron Parecki