The IESG has approved the following document: - 'OAuth 2.0 Security Best Current Practice' (draft-ietf-oauth-security-topics-29.txt) as Best Current Practice
This document is the product of the Web Authorization Protocol Working Group. The IESG contact persons are Paul Wouters, Deb Cooley and Roman Danyliw. A URL of this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/ Technical Summary This document describes best current security practice for OAuth 2.0. It updates and extends the threat model and security advice given in RFC 6749, RFC 6750, and RFC 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0. It further deprecates some modes of operation that are deemed less secure or even insecure. Working Group Summary The document updates security recommendations made in other documents and recommends against the use of some functionality from the OAuth 2.0 protocol. Changes have gone through long discussions and sometimes required new standardization efforts in the OAuth working group to address open issues. Document Quality The document summarizes security recommendations from a number of OAuth specifications and therefore there are many implementations of this specification available.The open banking sector, in particular, implements the guidelines provided by this specification. Personnel The Document Shepherd for this document is Hannes Tschofenig. The Responsible Area Director is Roman Danyliw. _______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
