Leave login to the browser
01The app delegates authentication to a separate browser security context.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4 ↗
RFC 8252 · § 4EXAMPLE
3 / 3
03
Return the grant to the native app.
The app receives delegated authority rather than the password.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6749 § 9RFC 8252 §§ 4, 8.12
The base framework described embedded and external options. This BCP requires the external user-agent pattern.
Read the updated RFC section ↗An external user-agent keeps credentials outside the app.
- Native apps MUST NOT use embedded user-agents for authorization (§ 8.12).
- An external user-agent prevents the app from reading page contents and browser cookies.
- Browser-owned in-app tabs retain browser isolation; they are different from app-controlled webviews.
The visual placement of a browser tab inside an app does not determine the security boundary. Ownership and isolation do.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy