RFCs, explained
with diagrams.
TRY···
Browse by category.
MATCHING SECTIONS
Related RFCs and changes
An RFC’s text stays the same after publication. Later RFCs may update or replace it. Each guide shows related documents and relevant changes.
These four RFCs cover OAuth, native apps, TLS requirements, and updated security rules.
Complete RFC library
- RFC 9700: Best Current Practice for OAuth 2.0 Security — Secure OAuth flows, protect tokens, and prevent 17 types of attacks.
- RFC 6749: The OAuth 2.0 Authorization Framework — How apps request permission and use access tokens.
- RFC 8252: OAuth 2.0 for Native Apps — How mobile and desktop apps request access through a browser.
- RFC 8996: Deprecating TLS 1.0 and TLS 1.1 — Why TLS 1.0 and 1.1 are no longer allowed, and what to use instead.
- RFC 1034: Domain Names: Concepts and Facilities — How DNS looks up names, delegates domains, and caches answers.
- RFC 9293: Transmission Control Protocol (TCP) — How TCP connects devices and delivers data reliably.
- RFC 9110: HTTP Semantics — HTTP requests, methods, responses, and caching.
- RFC 5321: Simple Mail Transfer Protocol — How email moves between servers and handles delivery failures.
- RFC 5905: Network Time Protocol, Version 4 — How devices measure and adjust their clocks over a network.
- RFC 8200: Internet Protocol, Version 6 (IPv6) Specification — Trace IPv6 addresses, fixed headers, extension chains, path MTU, fragmentation, and forwarding limits.
- RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport — Explore independent streams, stream identifiers, secure establishment, flow limits, loss recovery, and path migration.
- RFC 2131: Dynamic Host Configuration Protocol — Follow IPv4 address discovery, relay forwarding, lease renewal, reboot reuse, conflict checks, and parameter-only configuration.
- RFC 6455: WebSocket — Upgrade an HTTP connection, exchange framed messages in both directions, handle control frames, and close cleanly.
- RFC 9111: HTTP caching — Decide what may be stored, calculate freshness, revalidate with 304, and respect privacy, stale-response, and invalidation rules.
- RFC 8259: JSON data interchange — Build a JSON value tree, read objects and arrays, handle Unicode and numbers, and exchange data without ambiguous parsing.
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 — See a TLS handshake, separated keys, protected records, and the limits of early data.
- RFC 7519: JSON Web Token (JWT) — Take apart a JWT, read its claims, and distinguish decoding, verification, encryption, and trust.
- RFC 3986: Uniform Resource Identifier (URI): Generic Syntax — Take a URI apart, encode data safely, resolve relative references, and compare identifiers carefully.
- RFC 5322: Internet Message Format — Read email fields, addresses, reply threads, and the difference between syntax and trust.
- RFC 791: Internet Protocol — The historical IPv4 foundation: packet fields, routed delivery, lifetime, fragmentation, and reassembly.
- RFC 768: User Datagram Protocol — A minimal datagram transport: ports, message boundaries, length, checksum, and application responsibilities.
- RFC 792: Internet Control Message Protocol — IPv4 feedback and diagnostics, with clear historical limits on retired message types.
- RFC 826: An Ethernet Address Resolution Protocol — Resolve a local next-hop protocol address into a link-layer address, and understand the trust limits.
- RFC 1035: Domain Names: Implementation and Specification — DNS message fields, encoded names, records, compression, and transport; historical limits are identified.
- RFC 6891: Extension Mechanisms for DNS (EDNS(0)) — OPT metadata extends DNS with larger UDP limits, versions, extended codes, and option tuples.
- RFC 4033: DNS Security Introduction and Requirements — DNSSEC authenticates DNS data and denial of existence through signed records and a chain of trust.
- RFC 7858: Specification for DNS over Transport Layer Security (TLS) — Protect the DNS client-to-resolver transport with TLS while keeping authentication and DNSSEC distinct.
- RFC 8484: DNS Queries over HTTPS (DoH) — Map DNS wire messages onto HTTPS requests, responses, caching, and privacy boundaries.
- RFC 4271: A Border Gateway Protocol 4 (BGP-4) — Exchange and select reachability between autonomous systems using path attributes and local policy.
- RFC 2328: OSPF Version 2 — Discover neighbors, synchronize link-state databases, flood changes, compute shortest paths, and divide areas.
- RFC 4861: Neighbor Discovery for IP version 6 (IPv6) — Discover routers, resolve local neighbors, detect unreachable peers, and validate link-local control traffic.
- RFC 4862: IPv6 Stateless Address Autoconfiguration — Create addresses from local identifiers and advertised prefixes, check duplicates, and respect preferred and valid lifetimes.
- RFC 8415: Dynamic Host Configuration Protocol for IPv6 (DHCPv6) — The requested 2018 consolidation of DHCPv6: discovery, identities, prefix delegation, lifetime renewal, and relays. See RFC 9915 for its successor.
- RFC 9915: Dynamic Host Configuration Protocol for IPv6 (DHCPv6) — The current successor to RFC 8415: coherent address and prefix configuration, relay delivery, renewal, and reduced legacy mechanisms.
- RFC 8489: Session Traversal Utilities for NAT (STUN) — Discover a server-observed transport address and understand transaction matching, framing, and integrity limits.
- RFC 8656: Traversal Using Relays around NAT (TURN): Relay Extensions to STUN — Allocate a relayed address, authorize peers, send through the relay, and manage channels and lifetimes.
- RFC 9113: HTTP/2 — Multiplex HTTP exchanges, compress field sections, manage credits, and distinguish stream errors from connection shutdown.
- RFC 9114: HTTP/3 — Map HTTP to QUIC streams, use QPACK fields and dedicated control streams, and shut down without confusing request outcomes.
- RFC 9457: HTTP API problem details — Describe API failures with stable problem types, occurrence details, extensions, and safe disclosure.
- RFC 5789: HTTP PATCH — Apply a patch document atomically, guard the base version, advertise formats, and handle conflicts.
- RFC 4648: Base encodings — Turn bits into Base64, Base64url, Base32, and Base16 text while respecting padding and canonical form.
- RFC 3629: UTF-8 — Encode Unicode scalar values into one to four bytes, validate sequences, and understand BOM and security limits.
- RFC 9562: UUID identifiers — Read the 128-bit format, choose random or time-ordered identifiers, and keep uniqueness separate from secrecy.
- RFC 8949: CBOR binary data — Decode compact binary types, nested containers and tags, and choose deterministic serialization when a protocol needs it.
- RFC 4180: CSV records — Read records and fields, quote commas and newlines, escape quotes, and distinguish documented format from application typing.
- RFC 6376: DKIM mail signatures — Sign selected headers and a canonicalized body, fetch selector keys from DNS, and interpret signatures without confusing them with encryption.
- RFC 7208: SPF sender policy — Check an SMTP sender address against DNS-authorized IPs, evaluate mechanisms, limit DNS work, and recognize forwarding limitations.
- RFC 7489: DMARC alignment and policy — Align authenticated domains with the visible author, discover policy, and interpret reports and enforcement carefully.
- RFC 9989: DMARC domain policy — Use the current alignment rules and DNS tree walk to find author-domain policy; apply receiver judgment and keep reporting separate.
- RFC 9990: DMARC aggregate reports — Build XML feedback from message counts and authentication results, verify report recipients, and deduplicate reports without exposing message bodies.
- RFC 9991: DMARC failure reports — Diagnose individual failures using structured ARF feedback while verifying external recipients and limiting exposure of message content.
- RFC 9051: IMAP4rev2 mailbox access — Select mailboxes, keep stable UID state, fetch only needed parts, manage flags, and synchronize changes.
- RFC 1939: POP3 mail retrieval — Authorize access, retrieve and identify messages, mark deletions, and commit them only through the UPDATE state.
- RFC 2045: MIME message bodies — Label message bodies with types and charsets, choose transfer encodings, and distinguish bytes from meaning.
- RFC 5545: iCalendar events — Read calendar components, time zones, recurrence sets and exceptions, with event identity and alarm safety.
- RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2 — Understand the older handshake, record protection, key states, and the transition to TLS 1.3.
- RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3 — Follow the current TLS 1.3 handshake, fresh key shares, retry transcripts, key updates, and early-data limits.
- RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile — Read certificate fields, build a path to trust, enforce constraints, and check revocation.
- RFC 8555: Automatic Certificate Management Environment (ACME) — Follow certificate orders, replay-safe signed requests, domain challenges, and final issuance.
- RFC 4251: The Secure Shell (SSH) Protocol Architecture — Separate secure transport, user authentication, host trust, and multiplexed channels.
- RFC 7515: JSON Web Signature (JWS) — See the exact signing input, protection boundaries, multiple signatures, and replay limits.
- RFC 7516: JSON Web Encryption (JWE) — Open an encrypted envelope, separate content and key encryption, and enforce authentication.
- RFC 7517: JSON Web Key (JWK) — Represent keys, select from a key set, constrain operations, and keep private material private.
- RFC 7636: Proof Key for Code Exchange by OAuth Public Clients — Bind a code to a transaction-specific secret, and stop a stolen code at the token endpoint.
- RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage — Understand bearer possession, request placement, resource-server errors, and token leakage limits.
- RFC 8725: JSON Web Token Best Current Practices — Enforce algorithm policy, sound keys, nested verification, audience, and distinct token purposes.
- RFC 8445: Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal — Gather candidate addresses, test pairs, nominate a path, and restart when connectivity changes.
- RFC 3550: RTP: A Transport Protocol for Real-Time Applications — Separate media timestamps from sequence numbers, observe jitter, and read RTCP reports.
- RFC 3261: SIP: Session Initiation Protocol — Follow registration and session signaling while keeping media, dialogs, and transactions distinct.
- RFC 8866: SDP: Session Description Protocol — Read the session text, media scopes, timing, direction attributes, and the limits of a description.