OAuth 2.0 Threat Model and Security Considerations

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 71
Abstract: This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the OAuth 2.0 protocol. This document is not an Internet Standards Track specification; it is published for informational purposes.
Publication Date: 2013-01-01
Status Note: Informational
DOI: 10.17487/RFC6819
Link: https://doi.org/10.17487/RFC6819
Author(s): Torsten Lodderstedt
Mark McGloin
Phil Hunt
Keyword(s): Authorization, Authentication, HTTP, REST

Latest version of IETF RFC 6819

Document Versions — IETF RFC 6819

▶ IETF RFC 6819 (2013-01-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Amended by:

IETF RFC 9700 [Active*]

Normative Reference(s)

IETF RFC 6749 [Active*]
IETF RFC 6750 [Active*]

Bibliographic Reference(s)

3GPP.TS-22.016.201209 — IMEI EXTERNAL
Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", Work in Progress, December 2012. EXTERNAL
Ross, D. and T. Gondrom, "HTTP Header X-Frame-Options" , Work in Progress, October 2012. EXTERNAL
Lodderstedt, T., Ed., Dronia, S., and M. Scurtescu, "Token Revocation", Work in Progress, November 2012. EXTERNAL
Rydstedt, G., Bursztein, Boneh, D., and C. Jackson, "Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites", IEEE 3rd Web 2.0 Security and Privacy Workshop, May 2010, < http://elie.im/ publication/busting-frame-busting-a-study-of- clickjacking-vulnerabilities-on-popular-sites >. EXTERNAL
"Open Web Application Security Project Home Page", < https://www.owasp.org/ >. EXTERNAL
Maler, E., Ed., Mishra, P., Ed., and R. Philpott, Ed., "Bindings and Profiles for the OASIS Security Assertion Markup Language (SAML) V1.1", September 2003, < http://www.oasis-open.org/committees/download.php/3405/ oasis-sstc-saml-bindings-1.1.pdf >. EXTERNAL
Sissel, J., Ed., "SSL handshake latency and HTTPS optimizations", June 2010. EXTERNAL
Richer, J., Ed., Mills, W., Ed., and H. Tschofenig, Ed., "OAuth 2.0 Message Authentication Code (MAC) Tokens", Work in Progress, November 2012. EXTERNAL
Smarr, J., "Portable Contacts 1.0 Draft C", August 2008, < http://portablecontacts.net/ >. EXTERNAL
World Wide Web Consortium, "Frames in HTML documents", W3C HTML 4.01, December 1999, < http://www.w3.org/TR/html4/present/frames.html#h-16.5 >. EXTERNAL
Gross, T., "Security Analysis of the SAML Single Sign-on Browser/Artifact Profile", 19th Annual Computer Security Applications Conference, Las Vegas, December 2003. EXTERNAL
Cantor, S., Ed., Kemp, J., Ed., Philpott, R., Ed., and E. Maler, Ed., "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Standard saml-core-2.0-os, March 2005, < http://docs.oasis-open.org/security/saml/ v2.0/saml-core-2.0-os.pdf >. EXTERNAL
"OpenID Foundation Home Page", < http://openid.net/ >. EXTERNAL
Linn, J., Ed., and P. Mishra, Ed., "SSTC Response to "Security Analysis of the SAML Single Sign-on Browser/ Artifact Profile"", January 2005, < http://www.oasis-open.org/committees/download.php/ 11191/sstc-gross-sec-analysis-response-01.pdf >. EXTERNAL
Campbell, B., Mortimore, C., Jones, M., and Y. Goland, "Assertion Framework for OAuth 2.0", Work in Progress, December 2012. EXTERNAL
IETF RFC 2616 [Superseded*]
IETF RFC 2818 [Superseded*]
IETF RFC 4086 [Active*]
IETF RFC 4120 [Active*]
IETF RFC 4301 [Active, Amended*]
IETF RFC 5246 [Superseded*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6819.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6819, OAuth 2.0 Threat Model and Security Considerations. Available at https://doi.org/10.17487/RFC6819

Snippet:

IETF RFC 6819, OAuth 2.0 Threat Model and Security Considerations. Available at https://doi.org/10.17487/RFC6819

HTML (ISO 690 compliant)

Preview:

IETF RFC 6819, OAuth 2.0 Threat Model and Security Considerations. Available at https://doi.org/10.17487/RFC6819

Snippet:

<span class="citation"><cite>IETF RFC 6819</cite>, OAuth 2.0 Threat Model and Security Considerations. Available at <a href="https://doi.org/10.17487/RFC6819" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6819</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6819, OAuth 2.0 Threat Model and Security Considerations
doi: 10.17487/RFC6819
url: https://doi.org/10.17487/RFC6819

Snippet:

<li>
<cite id="bib-rfc6819">IETF RFC 6819</cite>, OAuth 2.0 Threat Model and Security Considerations
<span class="doi">10.17487/RFC6819</span>
</li>

Referenced By

IETF RFC 7636 [Active*]
IETF RFC 8252 [Active*]
IETF RFC 9700 [Active*]