Use an authorization code more than once..

Condition: After receiving an authorization code.

The client MUST NOT use the authorization code more than once.

Require TLS at its redirect endpoint..

Condition: If it relies on the authorization code for resource-owner authentication.

the client redirection endpoint MUST require the use of TLS.

Use code as the response_type value when requesting an authorization code..

Condition: When requesting an authorization code.

The value MUST be one of "code" for requesting an authorization code

Set response_type to code..

Condition: When constructing an authorization code grant authorization request.

Value MUST be set to "code".

Ignore unrecognized authorization response parameters..

Condition: When processing the authorization response.

The client MUST ignore unrecognized response parameters.

Set grant_type to authorization_code..

Condition: When exchanging an authorization code.

Value MUST be set to "authorization_code".

Use the same redirect_uri value in the authorization and token requests..

Condition: If redirect_uri was included in the authorization request.

their values MUST be identical.

Authenticate to the authorization server..

Condition: If confidential, issued client credentials, or assigned other authentication requirements.

the client MUST authenticate with the authorization server

Prevent authorization-code injection attacks and misuse of authorization codes..

Condition: When using the authorization code grant.

Clients MUST prevent authorization code injection attacks

Use a transaction-specific PKCE challenge or OpenID Connect nonce securely bound to the client and user agent..

Condition: When using PKCE or the permitted OpenID Connect nonce alternative.

the PKCE challenge or OpenID Connect nonce MUST be transaction-specific and securely bound

Include the response_type parameter in the authorization request..

Condition: When making an authorization endpoint request.

response_type REQUIRED.

Include the grant_type parameter in the token request..

Condition: When exchanging an authorization code.

grant_type REQUIRED.

Include the authorization code in the token request..

Condition: When exchanging an authorization code.

code REQUIRED.

Include redirect_uri in the token request..

Condition: If redirect_uri was included in the authorization request.

redirect_uri REQUIRED, if the "redirect_uri" parameter was included

Include client_id in the token request..

Condition: If the client is not authenticating to the authorization server.

client_id REQUIRED, if the client is not authenticating

Require TLS for its redirect URI..

Condition: If the redirect URI identifies a network resource.

the client SHOULD require the use of TLS with its redirection URI

Use a PKCE code challenge method that does not expose the verifier in the authorization request..

Condition: When using PKCE.

clients SHOULD use PKCE code challenge methods that do not expose the PKCE verifier

Issue authorization codes that are short-lived and single-use..

Condition: When issuing authorization codes.

Authorization codes MUST be short lived and single-use.

Authenticate the client and ensure that the code was issued to that client..

Condition: If the client can be authenticated.

authorization servers MUST authenticate the client and ensure that the authorization code was issued to the same client.

Ensure the redirect URI used to obtain the code is identical to the redirect URI supplied during code exchange..

Condition: For authorization code grant processing.

the authorization server MUST ensure that the redirection URI used to obtain the authorization code is identical

Require public clients to register their redirect URIs..

Condition: For authorization code grant clients.

The authorization server MUST require public clients

Validate a supplied redirect URI against the registered value..

Condition: If a redirect URI is supplied in the request.

the authorization server MUST validate it against the registered value.

Return an error response when response_type is missing or not understood..

Condition: If response_type is absent or the response type is not understood.

the authorization server MUST return an error response

Make the authorization code expire shortly after issuance..

Condition: When issuing an authorization code.

The authorization code MUST expire shortly after it is issued

Deny an attempt to reuse an authorization code..

Condition: If an authorization code is used more than once.

the authorization server MUST deny the request

Require client authentication for confidential clients and clients assigned credentials or other authentication requirements..

Condition: When processing an authorization code token request.

The authorization server MUST: require client authentication

Authenticate the client when client authentication is included..

Condition: When processing an authorization code token request containing client authentication.

The authorization server MUST: authenticate the client if client authentication is included

Ensure the code was issued to the authenticated confidential client or, for a public client, to the client_id in the request..

Condition: When processing an authorization code token request.

The authorization server MUST: ensure that the authorization code was issued to the authenticated confidential client

Verify that the authorization code is valid..

Condition: When processing an authorization code token request.

The authorization server MUST: verify that the authorization code is valid

Require redirect_uri when it appeared in the authorization request and ensure the values are identical..

Condition: When processing the corresponding token request.

The authorization server MUST: ensure that the "redirect_uri" parameter is present

Use exact string matching when comparing redirect URIs with registered URIs..

Condition: Except for port numbers in localhost redirect URIs of native applications.

authorization servers MUST utilize exact string matching

Support PKCE..

Condition: When supporting the authorization code grant.

Authorization servers MUST support PKCE

Enforce correct use of code_verifier at the token endpoint..

Condition: If the authorization request contained a valid PKCE code_challenge.

the authorization server MUST enforce the correct usage of code_verifier

Reject PKCE downgrade attempts by accepting code_verifier only when code_challenge was present in the authorization request..

Condition: When processing a token request containing code_verifier.

Authorization servers MUST mitigate PKCE downgrade attacks

Provide a way for clients to detect PKCE support..

Condition: When supporting the authorization code grant.

Authorization servers MUST provide a way to detect their support for PKCE.

Include the code parameter in the successful authorization response..

Condition: If the resource owner grants the access request.

code REQUIRED.

Return the exact state value received from the client..

Condition: If state was present in the authorization request.

state REQUIRED if the "state" parameter was present

Transmit authorization codes over a secure channel..

Condition: When transmitting authorization codes.

The transmission of authorization codes SHOULD be made over a secure channel

Require confidential clients to register their redirect URIs..

Condition: For authorization code grant clients.

SHOULD require confidential clients to register their redirection URIs.

Revoke, when possible, all tokens previously issued from a reused authorization code..

Condition: If an authorization code is used more than once.

SHOULD revoke (when possible) all tokens previously issued

Document the size of authorization code values it issues..

Condition: When issuing authorization codes.

The authorization server SHOULD document the size of any value it issues.

Limit the authorization code lifetime to no more than 10 minutes..

Condition: When issuing an authorization code.

A maximum authorization code lifetime of 10 minutes is RECOMMENDED.

Publish code_challenge_methods_supported in OAuth Authorization Server Metadata..

Condition: As the mechanism for advertising supported PKCE challenge methods.

It is RECOMMENDED for authorization servers to publish the element code_challenge_methods_supported

Use a deployment-specific mechanism to communicate PKCE support..

Condition: Instead of publishing code_challenge_methods_supported in OAuth Authorization Server Metadata.

Authorization servers MAY instead provide a deployment-specific way

Expose open redirectors that forward a browser to an arbitrary URI obtained from a query parameter..

Condition: For redirect-based flows.

Clients and authorization servers MUST NOT expose URLs that forward the user's browser to arbitrary URIs

Use PKCE..

Condition: When using the authorization code grant.

For confidential clients, the use of PKCE is RECOMMENDED

Use PKCE..

Condition: When using the authorization code grant.

Public clients MUST use PKCE