The current security advice for OAuth 2.0: an updated threat model, mitigations for attacks found since RFC 6749, and the deprecation of the implicit grant and other less secure modes.
No explainer written for this spec yet. The summary, relations and documented support below are maintained.
The current security advice for OAuth 2.0: an updated threat model, mitigations for attacks found since RFC 6749, and the deprecation of the implicit grant and other less secure modes.
flowchart LR s_oauth_security_bcp["OAuth 2.0 Security Best Current Practice"] s_oauth2["OAuth 2.0"] s_security_topics_update["Updates to OAuth 2.0 Security BCP"] s_browser_based_apps["OAuth 2.0 for Browser-Based Applications"] style s_oauth_security_bcp stroke-width:3px s_oauth_security_bcp -->|Works with| s_oauth2 s_security_topics_update -->|Extends| s_oauth_security_bcp s_browser_based_apps -->|Builds on| s_oauth_security_bcp
Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.
No sourced support entries collected yet. This says nothing about how widely it is used.
Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.
Nothing collected about this spec yet.