bk99.de entertain the web since 1997

bk99.de
RFC · AuthenticationStandard explained

RFC 9700: Running OAuth 2.0 securely

Summary

RFC 9700 brings together current security practices for OAuth 2.0 and rejects risky historical patterns. A flexible authorisation framework needs secure profiles and defaults. Best practices can later explicitly replace early standard options.

Ideas

  • Authorization code with PKCE protects public clients.
  • Exact redirect URI checks prevent redirection attacks.
  • Sender-constrained tokens reduce reuse after theft.

Remarks

  • RFC 9700 has the status “Best Current Practice”; current errata and successor documents should also be checked.

Recommendations

  • Use the authorization code flow with PKCE.
  • Disable outdated flows and check redirect URIs exactly.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2015

RFC 7519: JWT: Signed claims in JSON format

RFC 7519 defines compact JSON Web Tokens for transferable claims with signature or encryption. Self-contained tokens reduce lookups and make immediate revocation harder. Flexible cryptography requires strict checking of algorithms and claims.

Hostblogger · 2021

FIDO U2F as a second factor in the customer menu

Manuel Schmitt adds FIDO U2F to the customer menu and thereby supports physical as well as virtual security keys. FIDO U2F was offered in addition to SMS and OATH-TOTP. The web hosting management itself had not yet been switched over at the time of publication.

Hackaday · 2017

OAuth2 for Gmail on Linux and ESP8266

Hackaday explains token-based Gmail login so that scripts and microcontrollers can send email without a stored account password. Gmail documents its OAuth2 interface. The approach runs on Linux and the ESP8266.