Fake browsers and client impersonation
08A malicious app can mimic a browser or attempt to become the default HTTPS handler.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8.7 ↗
RFC 8252 · § 8.7EXAMPLE
3 / 3
03
Authenticate in the intended trusted context.
Keep the credential-handling boundary explicit.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Browser appearance is not browser isolation.
- An embedded page disguised as an external browser can capture credentials.
- A malicious default URI handler is a device-wide risk, not only an OAuth issue (§ 8.8).
- Do not silently reuse prior consent for a public client unless its identity can be assured (§ 8.6).
Browser-only authentication factors and platform app-identity capabilities can help. The RFC does not promise that OS dispatch defeats a compromised device.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy