Limit the damage of disclosure
05Audience and scope restriction reduce where and how a stolen token can be used.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5.2 ↗
RFC 6750 · § 5.2EXAMPLE
3 / 3
03
Expiry
After expiration, a correctly validating server rejects the token.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
The token must be protected in transit using TLS.
- The token must be protected in transit using TLS.
- Restrict tokens to intended recipients.
- Short lifetimes reduce exposure but do not themselves stop all replay.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy