Standards Documents Overview

OAuth 2.0 is a framework with multiple extensions that have been standardized over the years to support new use cases or to improve the security. The test cases in OAuch are based on the security specifications as written down in these OAuth-related standards documents. The following documents are supported:

• The OAuth 2.0 Authorization Framework (RFC6749)
• The OAuth 2.0 Authorization Framework: Bearer Token Usage (RFC6750)
• RFC8628 - OAuth 2.0 Device Authorization Grant (RFC8628)
• Proof Key for Code Exchange by OAuth Public Clients (RFC7636)
• OAuth 2.0 Threat Model and Security Considerations (RFC6819)
• JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (RFC7523)
• OAuth 2.0 Token Revocation (RFC7009)
• OAuth 2.0 Security Best Current Practice (draft 25) (SecBCP)
• OpenID Connect Core 1.0 incorporating errata set 1 (OIDC)
• OAuth 2.0 Form Post Response Mode (FormPost)
• Financial-grade API Security Profile (FAPI) 1.0 – Part 1: Baseline (FAPI1Base)
• Financial-grade API Security Profile (FAPI) 1.0 – Part 2: Advanced (FAPI1Adv)
• OAuth2 Attacks & Defenses (AttsDefs)