note · growing
Authorization
OAuth 2.1 with mandatory PKCE, audience validation, no token passthrough, CIMD over DCR.
For remote servers, authorization is the whole game. The spec settles on OAuth 2.1, and the details it tightens are the ones that get exploited.
PKCE, alwaysmandatory for every client, not just public ones
No implicit grantremoved from the spec entirely
Validate audienceonly accept tokens minted for you
No passthroughnever forward a client token to an upstream API
Two hardening changes worth knowing
- Issuer validation (RFC 9207). Credentials are bound to the issuer that minted them, which closes a class of mix-up attacks between authorization servers.
- CIMD replaces Dynamic Client Registration. Client ID Metadata Documents are now the supported path; DCR is formally deprecated.
Scope tokens to the minimum, and scope them per user — a server-wide service account is the confused deputy problem waiting to happen.