oauth.net
Threat Model and Security Considerations
RFC 6819 catalogues known attacks against OAuth 2.0 — both theoretical and demonstrated in the wild — and describes countermeasures for each, drawing on real implementation experience from major providers.
When to read this
Read RFC 6819 when you want a deep understanding of the attack surface of an OAuth 2.0 deployment. For a more current and actionable set of requirements, the Security Best Current Practice (RFC 9700) supersedes and extends this document — start there for new implementations, then refer back to RFC 6819 for the underlying threat analysis.
The document covers threats against every part of the OAuth flow: authorization endpoint attacks (CSRF, open redirect, clickjacking), token endpoint attacks (credential theft, brute force), token leakage via browser history and referrer headers, and attacks specific to particular grant types. Each threat includes a description, its impact, and specific countermeasures implementors should apply.
Related specs
- Security Best Current Practice RFC 9700 — supersedes this document