This is an updated test plan for a server, incorporating best current practices from RFC 9700 and the OAuth 2.1 Authorization Framework. This updated checklist removes the deprecated Implicit Grant flow and adds new requirements, recommendations, and security considerations.
- REQUIRED:
- The server MUST use HTTPS for all communication.
- The server MUST support the Authorization Code Grant with PKCE (
response_type=code). This is the only grant type recommended for public clients (e.g., single-page applications, native apps).
- Redirect URIs MUST be validated using an exact string match against a pre-registered list. Wildcard matching and partial path matching are NOT RECOMMENDED.