OAuth 2.1

Specification: draft-ietf-oauth-v2-1 (Internet-Draft, work in progress)

Versola is an OAuth 2.0 server (RFC 6749). OAuth 2.1 is an unfinished draft that consolidates RFC 6749 with the security guidance published since; this page records which of its requirements Versola already meets. It follows the draft as it stands and may lag behind it.

Status

Partially implemented. Checked claims: 6 of 8.

Mandatory PKCE

• PKCE is required for public clients, for every client of a fapi2 tenant, and for clients of apps fronted by edge
• PKCE required for every authorization code flow — not for confidential clients of a standard tenant, which may omit it because the client secret already proves who redeems the code

Removed grant types

The following grant types are removed by the draft and are not implemented:

• Implicit Grant — vulnerable to token leakage
• Resource Owner Password Credentials Grant — encourages password sharing

Stricter token handling

• Access tokens are accepted only in the Authorization header (Bearer or DPoP scheme) at /userinfo
• Tokens in URL query parameters or in the request body are refused
• Refresh token rotation with reuse detection — presenting a rotated token revokes the whole token family; sender-constrained refresh tokens are renewed in place instead

Redirect URI matching

• Exact string matching for redirect URIs
• Plain http is accepted only for loopback hosts (localhost, 127.0.0.1, [::1])
• Loopback redirect with any port (RFC 8252 §7.3) — each loopback URI, port included, is registered and matched exactly

Notes

• Authorization requests accept PKCE S256 only. The draft also allows plain where no S256 support exists, which Versola does not offer.
• The standard profile departs from the draft on PKCE for confidential clients, as above. The fapi2 profile does not.

Where to look

Security profiles shows where the standard and fapi2 profiles differ on PKCE and client authentication.