vulns.co
/
GKData.io MCP

Internet Engineering Task Force / RFC Editor · 1 min read

RFC 9700: Best Current Practice for OAuth 2.0 Security

Consensus guidance updating OAuth's security model with deployment experience, stronger protocol requirements, and deprecated insecure patterns. A primary reference for identity integration reviews.

Open the reference Technical StandardReviewed 2026-10-02

How to use this reference

Compare an owned integration's documented design against the standard and record deviations and compensating controls.

Before reading

  • OAuth roles and authorization flows
  • HTTP redirects and TLS
  • Basic token and session concepts

Context and limits

    Related visual models

    Approved grant context, including subject, client, permitted resources and actions, and a first-issuance or renewal request are both required inputs. Resolve trusted grant context and check that the grant and client are correct and requested authority remains within approval. Issue only bounded authority when all checks pass. Do not issue on mismatch or incomplete binding. Changing the approved authority requires a separate authorization decision; no automatic-consent loop is shown.

    Conceptual model Diagram

    Delegated authority stays within the approved grant

    Original editorial defensive synthesis, not a vendor architecture, protocol sequence or independently verified patch. The Google researcher describes lost client and permission binding through a device grant; proposed…

    Reviewed 2026-10-04Read

    Sources and provenance

    1. RFC 9700: Best Current Practice for OAuth 2.0 Security Internet Engineering Task Force / RFC Editor · reviewed 2026-10-02

    Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.

    GitHub snapshot 2026-10-04

    d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software