URLs leave extra copies
03A query-parameter token can persist in logs and other URL-handling systems.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 2.3 ↗
RFC 6750 · § 2.3EXAMPLE
3 / 3
03
Prefer the header
Keep bearer credentials out of the request URI.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
RFC 6750 discourages URI-query transmission except where other methods are impossible.
- RFC 6750 discourages URI-query transmission except where other methods are impossible.
- Modern OAuth guidance further discourages access tokens in URLs.
- TLS does not erase copies stored at endpoints or in logs.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy