VersolaVersola/docs
versola.kzGitHub
RUEN

OAuth 2.1

OAuth 2.1 consolidates OAuth 2.0 with modern security best practices

Specification: draft-ietf-oauth-v2-1

OAuth 2.1 is a consolidation of RFC 6749 (OAuth 2.0) with modern best practices and security improvements from various RFCs.

Status: Internet-Draft (work in progress)

Key Changes from OAuth 2.0

Mandatory PKCE

  • RFC 7636 (PKCE) is now required for all Authorization Code flows (previously optional)

Removed Grant Types

The following grant types are removed due to security concerns:

  • Implicit Grant — vulnerable to token leakage
  • Resource Owner Password Credentials Grant — encourages password sharing

Stricter Token Handling

  • Bearer tokens must be sent via Authorization: Bearer header only
  • Passing tokens in URL query parameters is prohibited
  • Refresh token rotation is recommended (Versola implements this)

Redirect URI Matching

  • Exact string matching for redirect URIs (no more substring matching)
  • Loopback addresses allowed for native apps
  • RFC 6749 — OAuth 2.0 (base specification)
  • RFC 7636 — PKCE (now mandatory)
  • RFC 6819 — OAuth 2.0 Threat Model and Security Considerations