IETF RFC 9700
[ACTIVE]
Best Current Practice for OAuth 2.0 Security
Metadata
- Publisher
- IETF
- Doc Type
- Best Practice
- Pages
- 46
- Abstract
- This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0. Further, it deprecates some modes of operation that are deemed less secure or even insecure.
- Publication Date
- 2025-01-01
- Status Note
- Best Current Practice
- DOI
10.17487/RFC9700- Link
- https://doi.org/10.17487/RFC9700
- Author(s)
- Torsten LodderstedtJohn BradleyAndrey LabunetsDaniel Fett
- Keyword(s)
- Threat Model
Latest version of IETF RFC 9700
Document Versions — IETF RFC 9700
-
▶ IETF RFC 9700 (2025-01-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 3986 [Active, Amended*]
- IETF RFC 6749 [Active*]
- IETF RFC 6750 [Active*]
- RFC6819 — RFC6819 EXTERNAL
- RFC7521 — RFC7521 EXTERNAL
- RFC7523 — RFC7523 EXTERNAL
- IETF RFC 8252 [Active*]
- RFC8414 — RFC8414 EXTERNAL
- RFC8705 — RFC8705 EXTERNAL
- IETF RFC 8996 [Active*]
- RFC9068 — RFC9068 EXTERNAL
Bibliographic Reference(s)
- 10.1145-2382196.2382238 — research.ubc EXTERNAL
- 10.1145-2660267.2660323 — research.cmu EXTERNAL
- 10.1145-2976749.2978387 — research.udel EXTERNAL
- 10.1145-3548606.3560692 — research.rub EXTERNAL
- 10.3233-JCS-140503 — research.jcs_14 EXTERNAL
- 10.48550-arXiv.1508.04324 — arXiv.1508.04324v2 EXTERNAL
- 10.48550-arXiv.1601.01229 — arXiv.1601.01229 EXTERNAL
- 10.48550-arXiv.1704.08539 — arXiv.1704.08539 EXTERNAL
- 10.48550-arXiv.1901.11520 — arXiv.1901.11520 EXTERNAL
- IETF.draft-bradley-oauth-jwt-encoded-state-09 — I-D.bradley-oauth-jwt-encoded-state EXTERNAL
- IETF.draft-ietf-oauth-token-binding-08 — I-D.ietf-oauth-token-binding EXTERNAL
- IETF.draft-ietf-oauth-v2-1-12 — I-D.ietf-oauth-v2-1 EXTERNAL
- Fries, C., "Security Analysis of Real-Life OpenID Connect Implementations", Master's thesis, Ruhr-Universität Bochum (RUB), 20 December 2020, <https://www.nds.rub.de/media/ei/arbeiten/2021/05/03/masterthesis.pdf>. EXTERNAL
- OWASP Foundation, "Unvalidated Redirects and Forwards Cheat Sheet", OWASP Cheat Sheet Series, <https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html>. EXTERNAL
- de Medeiros, B., Ed., Scurtescu, M., Tarjan, P., and M. Jones, "OAuth 2.0 Multiple Response Type Encoding Practices", The OpenID Foundation, 25 February 2014, <https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html>. EXTERNAL
- "Referer header includes URL fragment when opening link using New Tab", Chromium Issue Tracker, Issue ID: 40076763, <https://issues.chromium.org/issues/40076763>. EXTERNAL
- Lodderstedt, T. and B. Campbell, "Financial-grade API: JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)", The OpenID Foundation, 17 October 2018, <https://openid.net/specs/openid-financial-api-jarm.html>. EXTERNAL
- Sakimura, N., Bradley, J., Jones, M., and E. Jay, "OpenID Connect Discovery 1.0 incorporating errata set 2", The OpenID Foundation, 15 December 2023, <https://openid.net/specs/openid-connect-discovery-1_0.html>. EXTERNAL
- Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 2", The OpenID Foundation, 15 December 2023, <https://openid.net/specs/openid-connect-core-1_0.html>. EXTERNAL
- Jones, M. and B. Campbell, "OAuth 2.0 Form Post Response Mode", The OpenID Foundation, 27 April 2015, <https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html>. EXTERNAL
- IETF RFC 2119 [Active*]
- RFC7591 — RFC7591 EXTERNAL
- IETF RFC 7636 [Active*]
- IETF RFC 8174 [Active*]
- RFC8707 — RFC8707 EXTERNAL
- RFC9101 — RFC9101 EXTERNAL
- IETF RFC 9110 [Active*]
- RFC9126 — RFC9126 EXTERNAL
- RFC9207 — RFC9207 EXTERNAL
- RFC9396 — RFC9396 EXTERNAL
- RFC9440 — RFC9440 EXTERNAL
- RFC9449 — RFC9449 EXTERNAL
- W3C.CR-referrer-policy.20170126 — REFERRER-POLICY EXTERNAL
- W3C.csp2.20161215 — W3C.CSP-2 EXTERNAL
- W3C.webauthn-2.20210408 — W3C.WebAuthn EXTERNAL
- W3C.webcryptoapi.20170126 — W3C.WebCrypto EXTERNAL
- WHATWG.FETCH — WHATWG, “Fetch,” Living Standard, Aug. 2023, Available: https://fetch.spec.whatwg.org/. EXTERNAL
- WHATWG.HTML [Active, Versionless]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC9700.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 9700, Best Current Practice for OAuth 2.0 Security. Available at https://doi.org/10.17487/RFC9700
Snippet:
IETF RFC 9700, Best Current Practice for OAuth 2.0 Security. Available at https://doi.org/10.17487/RFC9700
HTML (ISO 690 compliant)
Preview:
IETF RFC 9700, Best Current Practice for OAuth 2.0 Security. Available at https://doi.org/10.17487/RFC9700
Snippet:
<span class="citation"><cite>IETF RFC 9700</cite>, Best Current Practice for OAuth 2.0 Security. Available at <a href="https://doi.org/10.17487/RFC9700" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9700</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 9700, Best Current Practice for OAuth 2.0 Security
doi: 10.17487/RFC9700
url: https://doi.org/10.17487/RFC9700
doi: 10.17487/RFC9700
url: https://doi.org/10.17487/RFC9700
Snippet:
<li> <cite id="bib-rfc9700">IETF RFC 9700</cite>, Best Current Practice for OAuth 2.0 Security <span class="doi">10.17487/RFC9700</span> </li>