The OAuth 2.0 Security Best Current Practice is the IETF’s consolidated, current security guidance for OAuth deployments. It refines and in places overrides the original RFC 6749 advice — most consequentially by recommending against the implicit grant and the resource owner password credentials grant, and by requiring PKCE for authorization code flows.
OAuth 2.0 Security Best Current Practice
OAuth 2.0 Security Best Current Practice (RFC 9700) — The OAuth 2.0 Security Best Current Practice is the IETF’s consolidated, current security guidance for OAuth deployments. It refines and in places overrides the original RFC 6749 advice — most consequentially by recommending against the implicit grant and the resource owner password credentials grant, and by requiring PKCE for authorization code flows.
- Implicit is out - The implicit grant returns an access token in the browser redirect fragment. The BCP recommends against it; OAuth 2.1 removes it.
- Password grant is out - The resource owner password credentials grant has the client handle the user’s password directly.
- PKCE everywhere - Proof Key for Code Exchange is required for authorization code flows, public and confidential clients alike.
- Sender-constrained tokens - Recommends binding tokens to a client via mTLS or DPoP rather than issuing pure bearer tokens.
This document is the authority behind the sharpest finding in The OAuth 2.0 Standard: 775 published API contracts still declare the implicit flow, 28.9% of every OAuth-using contract measured. The guidance has been settled for years. What has not happened is anyone re-reading the contracts, because no linter ships a rule that checks.
Referenced in API Evangelist papers
This standard shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this standard in the context of a real sector.
The OAuth 2.0 Standard
The authority behind the headline: 775 published contracts still declare the implicit flow this document recommends against — 28.9% of every OAuth-using contract measured.
