BCP 212
BCPs are stable identifiers for Best Current Practices. A BCP may consist of a single RFC or a group of RFCs related to a specific IETF process or recommended guidelines. The collection may become empty as the BCP evolves.
RFC 8252: BCP 212: OAuth 2.0 for Native Apps
- W. Denniss
- J. Bradley
- October 2017
- IETF publication
- Security Area
Abstract
OAuth 2.0 authorization requests from native apps should only be made through external user-agents, primarily the user's browser. This specification details the security and usability reasons why this is the case and how native apps and authorization servers can implement this best practice.
Abstract
OAuth 2.0 authorization requests from native apps should only be made through external user-agents, primarily the user's browser. This specification details the security and usability reasons why this is the case and how native apps and authorization servers can implement this best practice.
RFC 10017: BCP 212: OAuth 2.0 for Browser-Based Applications
- A. Parecki
- P. De Ryck
- D. Waite
- August 2026
- IETF publication
- Security Area
Abstract
This specification details the threats, attack consequences, security considerations, and best practices that must be taken into account when developing browser-based applications that use OAuth 2.0.
Abstract
This specification details the threats, attack consequences, security considerations, and best practices that must be taken into account when developing browser-based applications that use OAuth 2.0.