Auth Security

Core Principles

• OAuth 2.1 — Follow RFC 9700 (January 2025)
• PKCE Required — All clients must use PKCE
• Short-lived Tokens — Access tokens expire in 5-15 minutes
• Token Rotation — Refresh tokens are single-use
• HttpOnly Storage — Browser tokens in HttpOnly cookies
• Explicit Algorithm — Never trust JWT header algorithm
• No backwards compatibility — Delete deprecated auth flows

OAuth 2.1 Key Changes

Deprecated Flows (DO NOT USE)