3 ms·
OAuth 2.1 tightens it up a bit. I don't think very many people know that OAuth 2.1 exists, though.
by clhodapp 2y ago
OAuth 2.1 tightens it up a bit.
I don't think very many people know that OAuth 2.1 exists, though.
- portaouflop 2y ago2.1. is still in draft stage.
- dathinab 2y ago2.1 is mainly updating 2.0 with various later RFCs and usage recommendations, many of them are not drafts. And some document used e.g. https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics https://datatracker.ietf.org/doc/html/draft-ietf-oauth-secur... are technically a draft but practically a "life" document constantly kept up to date So while technically 2.1 is a draft, practically not following it means not following best practices of today so while you don't have to meet it fully if you care about security you really should use it as strict/strong recommendations. At least _longterm_ not doing so could be seen as negligence for high(er) security applications. The most important changes are listed here https://oauth.net/2.1/ https://oauth.net/2.1/