1

I was just looking at Spring Authorization Server and noticed that it mentions OAuth 2.1.

What are the differences between OAuth 2.0 and 2.1?

2
  • 1
    Read the manual oauth.net/2.1 Mar 12, 2022 at 13:20
  • 1
    Thanks for the link! I just looked at the current draft and posted my findings as an answer.
    – Matt Ke
    Mar 12, 2022 at 13:35

1 Answer 1

2

The OAuth 2.1 specification is currently in draft state. Because of that it currently not clear what will be the final differences.

See current draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-05

Excerpt from the current draft:

This draft consolidates the functionality in OAuth 2.0 [RFC6749], OAuth 2.0 for Native Apps ([RFC8252]), Proof Key for Code Exchange ([RFC7636]), OAuth 2.0 for Browser-Based Apps ([I-D.ietf-oauth-browser-based-apps]), OAuth Security Best Current Practice ([I-D.ietf-oauth-security-topics]), and Bearer Token Usage ([RFC6750]).

Where a later draft updates or obsoletes functionality found in the original [RFC6749], that functionality in this draft is updated with the normative changes described in a later draft, or removed entirely.

A non-normative list of changes from OAuth 2.0 is listed below:

  • The authorization code grant is extended with the functionality from PKCE ([RFC7636]) such that the default method of using the authorization code grant according to this specification requires the addition of the PKCE parameters

  • Redirect URIs must be compared using exact string matching as per Section 4.1.3 of [I-D.ietf-oauth-security-topics]

  • The Implicit grant (response_type=token) is omitted from this specification as per Section 2.1.2 of [I-D.ietf-oauth-security-topics]

  • The Resource Owner Password Credentials grant is omitted from this specification as per Section 2.4 of [I-D.ietf-oauth-security-topics]

  • Bearer token usage omits the use of bearer tokens in the query string of URIs as per Section 4.3.2 of [I-D.ietf-oauth-security-topics]

  • Refresh tokens for public clients must either be sender- constrained or one-time use as per Section 4.12.2 of [I-D.ietf-oauth-security-topics]

See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-05#section-10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.