RFC 9700 / THE FOUNDATIONS

Metadata, TLS & CORS

Discover the right endpoints, protect the channel, and distinguish browser redirects from cross-origin API calls.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 2.6 ↗

RFC 9700 · § 2.6EXAMPLE

4 / 4

Protect the resource request.

Use authenticated, encrypted communication to the resource server.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references

WHAT CHANGED

RFC 6749 § 1.6RFC 8996 § 1.1 + RFC 9700 § 2.6

RFC 8996 replaces older TLS minimums with TLS 1.2 and prohibits old-version fallback. RFC 9700 also recommends metadata use and end-to-end TLS under BCP 195.

Read the updated RFC section ↗

KEY POINT

Configure securely. Transport securely.

Publishing and using authorization-server metadata is RECOMMENDED, including support detection for PKCE.
Authorization responses MUST NOT use unencrypted connections; native loopback redirects are the HTTP exception. End-to-end TLS is RECOMMENDED.
CORS MAY support browser-accessed token, metadata, JWKS, and registration endpoints. It MUST NOT be enabled at the authorization endpoint.

DETAILS

Metadata helps avoid endpoint mistakes and supports key rotation and cryptographic agility. It is not a replacement for validating issuer and destination. Proxy and postMessage boundaries get their own chapters.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy

All chapters in this RFC