Protect the endpoint and browser boundary
06The revocation endpoint receives valuable credentials. A counterfeit endpoint can steal them, and browser transport options do not replace client or token validation.
A JSONP response is executable JavaScript, unlike merely parsing a data value. A malicious endpoint can inject code; do not infer safety from a callback-shaped response.
Source for this drawing: RFC 7009 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- CORS
- Cross-Origin Resource Sharing, controlling which browser origins can read a response.
- JSONP
- A legacy technique loading data through executable JavaScript callbacks.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The client MUST authenticate the revocation endpoint, including certificate validation, and obtain its location from a trustworthy source. HTTPS alone is insufficient if the destination is an attacker’s validly certified site.
- The client MUST authenticate the revocation endpoint, including certificate validation, and obtain its location from a trustworthy source. HTTPS alone is insufficient if the destination is an attacker’s validly certified site.
- Clients MUST verify an HTTPS endpoint URL. If the host is also reachable over HTTP, the server SHOULD offer the corresponding HTTP revocation service for accidental leaks but MUST NOT publish it as the endpoint.
- CORS support MAY be provided for user-agent applications. CORS is a browser response-sharing mechanism, not proof of client identity, token ownership or authorization.
- RFC 7009 also permits legacy JSONP GET with an optional callback, but warns that a malicious endpoint can inject script. This guide describes that historical option without recommending putting credentials in URLs.
Public-client requests contain a valid client_id; it is public information, not a client secret. Confidential clients use their configured authentication. The server checks that the token belongs to the requester. RFC7009 is not a general token-theft defense and does not implement single logout. TLS1.0/1.1 are prohibited by RFC8996; this guide does not repeat older TLS allowances from historical dependencies. Apply denial-of-service protections to lookup and processing. Reported erratum6663 is unverified; its proposed replacement with Bearer authorization is not adopted.
Read the RFC section ↗