Native apps and security boundaries
11The framework’s original native-app choices and TLS advice were narrowed by subsequent security RFCs.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 9 ↗
RFC 6749 · § 9EXAMPLE
3 / 3
03
Apply the updated token protections.
Use the framework together with the applicable BCPs.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6749 § 9RFC 8252 § 8.12
The choice of embedded or external user-agent is narrowed: native apps MUST NOT use embedded user-agents for authorization.
Read the updated RFC section ↗Read the base framework with its updates.
- RFC 6749 § 9 originally described embedded and external user-agent options.
- Its security discussion covers token secrecy, redirect validation, CSRF, clickjacking, phishing, and code leakage.
- Later documents update native-app authorization, transport requirements, and grant security; they do not erase the base framework.
RFC 8996 directly updates RFC 6749’s older TLS references. RFC 9700 complements, rather than replaces, the framework.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
PrivacyAll chapters in this RFC
- Four roles, one delegation
- Public and confidential clients
- Two endpoints, two channels
- Authorization code grant
- Implicit grant: historical behavior
- Password grant: now prohibited
- Client credentials and extension grants
- Token responses and failures
- Refresh without another prompt
- Scope and protected resources
- Native apps and security boundaries