Loopback callbacks on desktop
05A temporary local listener can receive the browser’s authorization response.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.3 ↗
RFC 8252 · § 7.3EXAMPLE
4 / 4
04
Check the transaction and close the listener.
Exchange the code with its verifier over the protected token channel.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Bind only to the loopback interface.
- Use loopback IP literals and an available ephemeral port; servers MUST allow the port to vary.
- Try IPv4 and IPv6 as supported. Listen only for the authorization transaction, then close the port.
- The local redirect may use HTTP because it stays on the device; localhost names are NOT RECOMMENDED (§ 8.3).
Other local apps may still intercept some loopback flows. The local transport exception does not remove the PKCE requirement.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy