Search results

CORS Origin Validation for Token Endpoint

Status: Open.

#235 In oauth-wg/oauth-v2-1;

· tennantje opened on Dec 23, 2025

Ensure open redirector language from RFC9700 is referenced

Status: Open.

#234 In oauth-wg/oauth-v2-1;

· aaronpk opened on Dec 7, 2025

make mix-up mitigation via issuer mandatory

Status: Open.

#233 In oauth-wg/oauth-v2-1;

· will-bartlett opened on Nov 20, 2025

Sender-constrained refresh tokens examples improvement

Status: Open.

#232 In oauth-wg/oauth-v2-1;

· sakimura opened on Nov 6, 2025

Protocol Flow Diagram

Status: Open.

#231 In oauth-wg/oauth-v2-1;

· jricher opened on Nov 4, 2025

Clarify the PKCE mechanism

Status: Open.

#220 In oauth-wg/oauth-v2-1;

· dickhardt opened on Sep 15, 2025

Phishing/Audience Mix-Up Mitigation for Resources

Status: Open.

#215 In oauth-wg/oauth-v2-1;

· mcguinness opened on Jun 11, 2025

Make PKCE optional when DPoP + PAR are used

Status: Open.

#214 In oauth-wg/oauth-v2-1;

· matthieusieben opened on Jun 3, 2025

guidance on issues of using personal oauth flows for a service to get long term access and then refresh fails and then service does not have access

Status: Open.

#213 In oauth-wg/oauth-v2-1;

· dickhardt opened on May 14, 2025

guidance on rotating refreshing tokens and dealing with

Status: Open.

#212 In oauth-wg/oauth-v2-1;

· dickhardt opened on May 14, 2025

Refresh Tokens

Status: Open.

#211 In oauth-wg/oauth-v2-1;

· PieterKas opened on May 2, 2025

·  

version -15

Reorganize section 7.1.1

Status: Open.

#200 In oauth-wg/oauth-v2-1;

· tlodderstedt opened on Dec 19, 2024