Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations

Torsten Lodderstedt <> Thu, 10 January 2013 06:29 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CFC0121F8698 for <>; Wed, 9 Jan 2013 22:29:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.248
X-Spam-Status: No, score=-2.248 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EI8rcOG62s6F for <>; Wed, 9 Jan 2013 22:29:15 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 0817721F8681 for <>; Wed, 9 Jan 2013 22:29:14 -0800 (PST)
Received: from [] (helo=[]) by with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.68) (envelope-from <>) id 1TtBdU-0006TV-Pl; Thu, 10 Jan 2013 07:29:10 +0100
Date: Thu, 10 Jan 2013 07:29:05 +0100
Message-ID: <>
Importance: normal
From: Torsten Lodderstedt <>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=""
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC1vbmxpbmUuZGU=
Subject: Re: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Torsten Lodderstedt <>
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 10 Jan 2013 06:29:17 -0000

Thanks! Mike Jones <> hat geschrieben:Congratulations on this achievement, guys!

-- Mike

-----Original Message-----
From: [] On Behalf Of
Sent: Monday, January 07, 2013 1:40 PM
Subject: [OAUTH-WG] RFC 6819 on OAuth 2.0 Threat Model and Security Considerations

A new Request for Comments is now available in online RFC libraries.

        RFC 6819

        Title:      OAuth 2.0 Threat Model and 
                    Security Considerations 
        Author:     T. Lodderstedt, Ed.,
                    M. McGloin, 
                    P. Hunt
        Status:     Informational
        Stream:     IETF
        Date:       January 2013
        Pages:      71
        Characters: 158332
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-oauth-v2-threatmodel-08.txt


This document gives additional security considerations for OAuth, beyond those in the OAuth 2.0 specification, based on a comprehensive threat model for the OAuth 2.0 protocol.  This document is not an Internet Standards Track specification; it is published for informational purposes.

This document is a product of the Web Authorization Protocol Working Group of the IETF.

INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see

For searching the RFC series, see
For downloading RFCs, see

Requests for special distribution should be addressed to either the author of the RFC in question, or to  Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC

OAuth mailing list