The OAuth 2.1 Authorization Framework#

Dick Hardt (Hellō), Aaron Parecki (Okta), Torsten Lodderstedt (SPRIND)

• Why: OAuth 2.1 will be the baseline spec every identity product implements for the next decade. It obsoletes RFC 6749 and RFC 6750, folding a decade of security BCPs into one normative document — anything the PM ships that speaks OAuth will be measured against it.
• What: A consolidation of RFC 6749 (core), RFC 8252 (native apps), RFC 9700 (security BCP), and RFC 10017 (browser-based apps) into a single framework, removing features found insecure in RFC 9700 — the TOC confirms removal of the implicit grant, changes to the redirect URI parameter in token requests, and deeply reworked security considerations including mix-up defenses via issuer identification and distinct redirect URIs, sender-constrained tokens (DPoP, mTLS) promoted to SHOULD, and extensive native/browser app guidance.
• How: Same grant architecture (authorization code, refresh, client credentials, extension grants) with the insecure options deleted; supports both bearer and sender-constrained access tokens; explicitly HTTP-only.
• Where applicable: Universal for OAuth implementations. Maturity is high: WG document at -17 with a WG milestone of submission to IESG by Dec 2026. (Note: the slides link attached to this agenda item actually presents a different OAuth draft — the Identity Assertion Authorization Grant — so use the draft text itself.)