oauth-v2-1

oauth-v2-1 copied to clipboard

## Question It seems that there are non-TLS-based implementations of OAuth. Should we better decouple the flows from channel requirements? See https://datatracker.ietf.org/doc/rfc9200/

ioggstream

reorganize access token threats section

tlodderstedt

There are two reference errors in the following paragraph in [Section 4.1.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-4.1.1): > Clients MUST use code_challenge and code_verifier and authorization servers MUST enforce their use except under the conditions...

mrcaidev

RFC9449 appeared twice in [Appendix D. Extensions](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#name-extensions). To prevent similar issues from happening, I think these extensions can be sorted by their RFC serial number.

mrcaidev

see 1.4 > Access tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server. - separate out what...

dickhardt