OAuth 3
This document just graduated to the full WG[0][1]. So this isn&#x27;t a full fledged, ready to implement, draft.<p>I&#x27;ve been doing some research on this for an upcoming presentation and it seems this was a union of the design ideas of two draft documents TxAuth and OAuth.xyz, which means there&#x27;s a few issues that need to be resolved. I&#x27;m sure they&#x27;d welcome respectful feedback.<p>From the WG&#x27;s charter[2], they are looking for feedback and comments and expect last call for the core protocol in July 2021.<p>It&#x27;s still very much a work in progress. I counted the TBDs and &quot;Editor&#x27;s notes&quot; and found an average of one of these &quot;TODO&quot; markers per page of the draft.<p>I&#x27;m excited about the more modern developer ergonomics (using JSON is a step up from using form params), the ability for an RC to request user info at the same time (folding in some of OIDC), and fact they&#x27;ve explicitly built interaction extensions into the model. OAuth2 often assumes a browser with redirect capabilities and there are some inelegant solutions that arise from that[3]. Still a lot of things to iron out, for sure, though.<p>That said, I think OAuth2 will still be common 3 years from now, and if OAuth2 satisfies your needs, you aren&#x27;t forced to move on to this new, explicitly not backward compatible[4], auth protocol.<p>[0]: <a href="https:&#x2F;&#x2F;www.ietf.org&#x2F;archive&#x2F;id&#x2F;draft-ietf-gnap-core-protocol-00.txt" rel="nofollow">https:&#x2F;&#x2F;www.ietf.org&#x2F;archive&#x2F;id&#x2F;draft-ietf-gnap-core-protoco...</a><p>[1]: <a href="https:&#x2F;&#x2F;mailarchive.ietf.org&#x2F;arch&#x2F;msg&#x2F;txauth&#x2F;UkvrBXkMk9YMl7m6N-YxhN7Zm1w&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mailarchive.ietf.org&#x2F;arch&#x2F;msg&#x2F;txauth&#x2F;UkvrBXkMk9YMl7m...</a><p>[2]: <a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;wg&#x2F;gnap&#x2F;about&#x2F;" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;wg&#x2F;gnap&#x2F;about&#x2F;</a><p>[3]: <a href="https:&#x2F;&#x2F;fusionauth.io&#x2F;blog&#x2F;2020&#x2F;08&#x2F;19&#x2F;securing-react-native-with-oauth&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fusionauth.io&#x2F;blog&#x2F;2020&#x2F;08&#x2F;19&#x2F;securing-react-native-...</a> shows that you have to have a redirect with a custom scheme for a mobile app. Seems weird to me.<p>[4]: &quot;Although the artifacts for this work are not intended or expected to be backwards-compatible with OAuth 2.0 or OpenID Connect, the group will attempt to simplify migrating from OAuth 2.0 and OpenID Connect to the new protocol where possible.&quot; - <a href="https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;wg&#x2F;gnap&#x2F;about&#x2F;" rel="nofollow">https:&#x2F;&#x2F;datatracker.ietf.org&#x2F;wg&#x2F;gnap&#x2F;about&#x2F;</a>