oauth21-implementation
Installation
SKILL.md
OAuth 2.1 Implementation for Authorization Servers
Security Requirement
Authorization servers MUST implement OAuth 2.1 for both confidential and public clients. OAuth 2.1 consolidates security best practices from OAuth 2.0 and its extensions into a single specification.
Key OAuth 2.1 Requirements
| Requirement | Details |
|---|---|
| PKCE required | All authorization code grants MUST use PKCE (RFC 7636), even for confidential clients |
| Redirect URI exact matching | Redirect URIs MUST be compared using exact string matching |
| No implicit grant | The implicit grant type is removed |
| No resource owner password grant | The ROPC grant type is removed |
| Refresh token rotation | Refresh tokens MUST be sender-constrained or one-time use |
| Bearer token usage | Per RFC 6750 with additional security requirements |