RFC 9700 / THE FOUNDATIONS

Retire unsafe grants

Avoid tokens in the front-channel response. Never collect the resource owner’s password through the password grant.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 2.4 ↗

RFC 9700 · § 2.4DEFENSE

3 / 3

Exchange at the token endpoint.

The back-channel exchange enables code replay checks and sender-constrained tokens.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

WHAT CHANGED

RFC 6749 § 4.2 and 4.3RFC 9700 § 2.1.2

The password grant is now prohibited (§ 2.4). Implicit and other front-channel token responses are discouraged unless injection and leakage are mitigated (§ 2.1.2).

Read the updated RFC section ↗

KEY POINT

Prefer the code flow; retire the password grant.

The resource owner password credentials grant MUST NOT be used.
Clients SHOULD NOT use implicit or other responses issuing access tokens at the authorization endpoint, unless injection and leakage are mitigated.
Clients SHOULD use code or a response that issues access tokens at the token endpoint.

DETAILS

The distinction matters: the password grant is prohibited; implicit carries a SHOULD NOT with stated conditions. Password grants also obstruct multi-step authentication and origin-bound credentials.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy

All chapters in this RFC