RFC 6819: OAuth 2.0 Threat Model and Security Considerations

This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the…

Read RFC 6819 on the RFC Editor

Outgoing relationships (8 related RFCs)

Normative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Normative reference — RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
Informative reference — RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
Informative reference — RFC 4301: Security Architecture for the Internet Protocol
Informative reference — RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1
Informative reference — RFC 4086: Randomness Requirements for Security
Informative reference — RFC 2818: HTTP Over TLS
Informative reference — RFC 4120: The Kerberos Network Authentication Service (V5)

Incoming relationships (11 related RFCs)

Updated by, Normatively referenced by — RFC 9700: Best Current Practice for OAuth 2.0 Security
Normatively referenced by — RFC 7592: OAuth 2.0 Dynamic Client Registration Management Protocol
Informatively referenced by — RFC 9200: Authentication and Authorization for Constrained Environments Using the OAuth 2.0 Framework (ACE-OAuth)
Informatively referenced by — RFC 7009: OAuth 2.0 Token Revocation
Informatively referenced by — RFC 7636: Proof Key for Code Exchange by OAuth Public Clients
Informatively referenced by — RFC 7644: System for Cross-domain Identity Management: Protocol
Informatively referenced by — RFC 8252: OAuth 2.0 for Native Apps
Informatively referenced by — RFC 7635: Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization
Informatively referenced by — RFC 7643: System for Cross-domain Identity Management: Core Schema
Informatively referenced by — RFC 7628: A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth
Informatively referenced by — RFC 8176: Authentication Method Reference Values