BCP 212

Get notified when:

An RFC is added to or removed from this BCP
A RFC within the collection changes status, obsoleted by, updates, updated by, or subseries.

BCPs are stable identifiers for Best Current Practices. A BCP may consist of a single RFC or a group of RFCs related to a specific IETF process or recommended guidelines. The collection may become empty as the BCP evolves.

RFC 8252: BCP 212: OAuth 2.0 for Native Apps

Best Current Practice

W. Denniss
J. Bradley

October 2017
IETF publication
Security Area

Abstract

OAuth 2.0 authorization requests from native apps should only be made through external user-agents, primarily the user's browser. This specification details the security and usability reasons why this is the case and how native apps and authorization servers can implement this best practice.

Abstract

RFC 10017: BCP 212: OAuth 2.0 for Browser-Based Applications

Best Current Practice

A. Parecki
P. De Ryck
D. Waite

August 2026
IETF publication
Security Area

Abstract

This specification details the threats, attack consequences, security considerations, and best practices that must be taken into account when developing browser-based applications that use OAuth 2.0.

BCP 212

Subscribe to BCP 212

RFC 8252: BCP 212: OAuth 2.0 for Native Apps

Abstract

Abstract

RFC 10017: BCP 212: OAuth 2.0 for Browser-Based Applications

Abstract

Abstract