What changes for OAuth?
05The TLS deprecation updates the older OAuth framework’s transport baseline.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 1.1 ↗
RFC 8996 · § 1.1EXAMPLE
3 / 3
03
Protect the API path too.
The later OAuth BCP links transport security to BCP 195.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6749 § 1.6RFC 8996 § 1.1
Older TLS minimum-version references are replaced with TLS 1.2, and fallback to TLS 1.0 or 1.1 is prohibited.
Read the updated RFC section ↗A framework reference must be read with its updates.
- RFC 8996 explicitly updates RFC 6749 and RFC 6750 among many other documents.
- Minimum TLS 1.0 or 1.1 references are replaced by TLS 1.2, and fallback to old versions is prohibited.
- RFC 9700 later recommends end-to-end TLS according to BCP 195 for client-to-resource-server traffic.
RFC 8996 is related to the OAuth story through transport requirements. It is not an OAuth protocol version.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy