{
  "$schema": "/api/schemas/documents.schema.json",
  "apiVersion": "1.1.0",
  "lastModified": "2026-10-15T16:41:57.708Z",
  "sourcePath": "src/main/data/docs",
  "docId": "RFC9700",
  "document": {
    "abstract": "This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0. Further, it deprecates some modes of operation that are deemed less secure or even insecure.",
    "abstract$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML abstract",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "authors": [
      {
        "name": "Torsten Lodderstedt"
      },
      {
        "name": "John Bradley"
      },
      {
        "name": "Andrey Labunets"
      },
      {
        "name": "Daniel Fett"
      }
    ],
    "authors$meta": {
      "confidence": "high",
      "note": "Parsed from Datatracker doc page article:author (profile full names)",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "docId": "RFC9700",
    "docId$meta": {
      "confidence": "high",
      "note": "Derived from RFC number or Datatracker identifier",
      "originalValue": null,
      "source": "resolved",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "docLabel": "IETF RFC 9700",
    "docLabel$meta": {
      "confidence": "high",
      "note": "Constructed from provider and document identifier",
      "originalValue": null,
      "source": "resolved",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "docNumber": "9700",
    "docNumber$meta": {
      "confidence": "high",
      "note": "Parsed from RFC info page report metadata",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "docTitle": "Best Current Practice for OAuth 2.0 Security",
    "docTitle$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML title",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "docType": "Best Practice",
    "docType$meta": {
      "confidence": "high",
      "note": "Mapped from Datatracker std_level or RFC status text",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "doi": "10.17487/RFC9700",
    "doi$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML doi",
      "originalValue": null,
      "source": "resolved",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "href": "https://doi.org/10.17487/RFC9700",
    "href$meta": {
      "confidence": "high",
      "note": "Derived from DOI (https://doi.org/<doi>)",
      "originalValue": null,
      "source": "resolved",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "keywords": [
      "Threat Model"
    ],
    "keywords$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML keywords",
      "originalValue": [
        "Threat Model",
        "Mitigations"
      ],
      "overridden": true,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-15T16:41:57.708Z",
      "version": "extractDocs.js@commit:0f51bb226575"
    },
    "pages": "46",
    "pages$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML page-count",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "publicationDate": "2025-01-01",
    "publicationDate$meta": {
      "confidence": "high",
      "note": "Parsed from RFC index XML date",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "publisher": "IETF",
    "publisher$meta": {
      "confidence": "high",
      "note": "Static: provider",
      "originalValue": null,
      "source": "parsed",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "references": {
      "bibliographic": [
        "10.48550-arXiv.1508.04324",
        "10.48550-arXiv.1601.01229",
        "10.48550-arXiv.1704.08539",
        "10.48550-arXiv.1901.11520",
        "IETF.draft-bradley-oauth-jwt-encoded-state-09",
        "IETF.draft-ietf-oauth-v2-1-12",
        "10.1145-2660267.2660323",
        "10.3233-JCS-140503",
        "10.1145-3548606.3560692",
        "10.1145-2382196.2382238",
        "10.1145-2976749.2978387",
        "RFC2119",
        "RFC7591",
        "RFC7636",
        "RFC8174",
        "RFC8707",
        "RFC9101",
        "RFC9110",
        "RFC9126",
        "RFC9207",
        "RFC9396",
        "RFC9440",
        "RFC9449",
        "IETF.draft-ietf-oauth-token-binding-08",
        "W3C.csp2.20161215",
        "W3C.CR-referrer-policy.20170126",
        "W3C.webauthn-2.20210408",
        "W3C.webcryptoapi.20170126",
        "WHATWG.FETCH",
        "WHATWG.HTML",
        "orphan/RFC9700/h:7215b390",
        "orphan/RFC9700/h:eba04d4a",
        "orphan/RFC9700/h:57baeaed",
        "orphan/RFC9700/h:d2eb9cdc",
        "orphan/RFC9700/h:cacfea5e",
        "orphan/RFC9700/h:b05dab4f",
        "orphan/RFC9700/h:20c0b4b4",
        "orphan/RFC9700/h:17d6532a"
      ],
      "bibliographic$meta": {
        "confidence": "high",
        "note": "Parsed from RFC HTML references/informative sections",
        "originalValue": [],
        "source": "parsed",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "normative": [
        "RFC8996",
        "RFC3986",
        "RFC6749",
        "RFC6750",
        "RFC6819",
        "RFC7521",
        "RFC7523",
        "RFC8252",
        "RFC8414",
        "RFC8705",
        "RFC9068"
      ],
      "normative$meta": {
        "confidence": "high",
        "note": "Parsed from RFC HTML normative references sections",
        "originalValue": [],
        "source": "parsed",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      }
    },
    "resolvedHref": "https://www.rfc-editor.org/info/rfc9700/",
    "resolvedHref$meta": {
      "confidence": "high",
      "note": "Final URL resolved via URL redirect verification",
      "originalValue": null,
      "source": "resolved",
      "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
      "updated": "2026-10-14T18:51:43.241Z",
      "version": "extractDocs.js@commit:673dd514c094"
    },
    "status": {
      "active": true,
      "active$meta": {
        "confidence": "high",
        "note": "Derived from supersession relationship fields",
        "originalValue": null,
        "source": "resolved",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "amends": [
        "RFC6749",
        "RFC6750",
        "RFC6819"
      ],
      "amends$meta": {
        "confidence": "high",
        "note": "Parsed from RFC index XML",
        "originalValue": [],
        "source": "parsed",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "errataExist": false,
      "errataExist$meta": {
        "confidence": "high",
        "note": "Derived from presence of errata links on RFC/Datatracker pages",
        "originalValue": null,
        "source": "parsed",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "latestVersion": true,
      "latestVersion$meta": {
        "confidence": "high",
        "note": "Derived from supersession relationship fields",
        "originalValue": null,
        "source": "resolved",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "statusNote": "Best Current Practice",
      "statusNote$meta": {
        "confidence": "high",
        "note": "Mapped from Datatracker doc.json std_level",
        "originalValue": null,
        "source": "parsed",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      },
      "superseded": false,
      "superseded$meta": {
        "confidence": "high",
        "note": "Derived from supersession relationship fields",
        "originalValue": null,
        "source": "resolved",
        "sourceUrl": "https://www.rfc-editor.org/info/rfc9700/",
        "updated": "2026-10-14T18:51:43.241Z",
        "version": "extractDocs.js@commit:673dd514c094"
      }
    }
  }
}