[Announcement] OAuth2.1 and OAuth3 drafts

OAuth2.1 and OAuth3 drafts has been announced.

OAuth 2.1:

• RFC6749 - OAuth 2.0 Core
• RFC6750 - Bearer token usage
• RFC7636 - PKCE
• Native App & Browser-Based App BCPs(best current practices)
• Security BCP(best current practice):
  • MUST support PKCE for all client types
  • No password grant
  • No implicit flow
  • Exact string matching for redirect URIs
  • No access tokens in query string
  • Refresh tokens must be sender-constrained or one-time use

OAuth 3:

• In development under a new IETF working group
• Re-thinking OAuth from the ground up
• Not backwards compatible
• Consolidate all various use cases in OAuth into a new framework

---

It seems to me that changes to specification should be applied:

• Deprecate implicit in OAuth Flows Object
• Deprecate password in OAuth Flows Object
• Deprecate in: query for apiKey type of security scheme(this one not sure, maybe apiKey isn’t related to access tokens)

Don’t know whether I should subscribe @aaronpk to this thread, but at least he can confirm that I retyped text from his What’s New With OAuth and OIDC? video presentation correctly.

[ponelat]

Can we consider adding a flag to indicate that PKCE is used for Authorization flows? We’re currently doing this out-of-band for some tooll, ie: https://github.com/swagger-api/swagger-ui/pull/7438.

[philsturgeon]

Yep, OpenAPI is not here to tell people how to build an API, its just a language for letting them describe any piece of junk they might need to describe. I often take the approach of

1. Document the mess so you can see how bad things are
2. Refactor the worst bits first and…
3. Write style guides and standards to help folks avoid similar mistakes in the future

If you take away stuff people need to do 1, you don’t get to 2 or 3.