Access Token Leak in Browser History

An attacker could obtain the token from the browser's history. Note that this means the attacker needs access to the particular device.

OAuth 2.0 Threat Model and Security Considerations (RFC6819, section


This threat is considered fully mitigated if all the test cases from the following test set succeed.

Back to the threat overview