RFC 10027 - Best Current Practice for Security of Cross-Device Flows

Skip to main content

Javascript disabled? Like other modern websites, the IETF Datatracker relies on Javascript.<br>Please enable Javascript for full functionality.

Best Current Practice for Security of Cross-Device Flows

RFC 10027<br>also known as BCP 247

Status

Email expansions

History

Document<br>Type

RFC

- Best Current Practice

(August 2026)

Was<br>draft-ietf-oauth-cross-device-security<br>(oauth WG)

Authors

P. Kasselman

D. Fett

F. Skokan

Last updated

2026-08-11

RFC stream

Internet Engineering Task Force (IETF)

Formats

txt

html

xml

pdf

htmlized

bibtex

Additional resources

Mailing list discussion

IESG

Responsible AD

Deb Cooley

Send notices to

(None)

Email authors

Email WG

IPR

References

Referenced by

Get editor source

Search Lists

RFC 10027

Internet Engineering Task Force (IETF) P. Kasselman<br>Request for Comments: 10027 Defakto Security<br>BCP: 247 D. Fett<br>Category: Best Current Practice Authlete<br>ISSN: 2070-1721 F. Skokan<br>Okta<br>August 2026

Best Current Practice for Security of Cross-Device Flows

Abstract

This document describes threats against cross-device flows along with<br>practical mitigations, protocol selection guidance, and a summary of<br>formal analysis results identified as relevant to the security of<br>cross-device flows. It serves as a security guide to system<br>designers, architects, product managers, security specialists, fraud<br>analysts, and engineers implementing cross-device flows.

Status of This Memo

This memo documents an Internet Best Current Practice.

This document is a product of the Internet Engineering Task Force<br>(IETF). It represents the consensus of the IETF community. It has<br>received public review and has been approved for publication by the<br>Internet Engineering Steering Group (IESG). Further information on<br>BCPs is available in Section 2 of RFC 7841.

Information about the current status of this document, any errata,<br>and how to provide feedback on it may be obtained at<br>https://www.rfc-editor.org/info/rfc10027.

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the<br>document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal<br>Provisions Relating to IETF Documents<br>(https://trustee.ietf.org/license-info) in effect on the date of<br>publication of this document. Please review these documents<br>carefully, as they describe your rights and restrictions with respect<br>to this document. Code Components extracted from this document must<br>include Revised BSD License text as described in Section 4.e of the<br>Trust Legal Provisions and are provided without warranty as described<br>in the Revised BSD License.

Table of Contents

1. Introduction<br>1.1. Cross-Device Authorization<br>1.2. Cross-Device Session Transfer<br>1.3. Defending Against Cross-Device Attacks<br>1.4. Conventions and Terminology<br>2. Best Practices<br>3. Cross-Device Flow Patterns<br>3.1. Cross-Device Authorization<br>3.1.1. User-Transferred Session Data Pattern<br>3.1.2. Backchannel-Transferred Session Pattern<br>3.1.3. User-Transferred Authorization Data Pattern<br>3.2. Cross-Device Session Transfer<br>3.2.1. Cross-Device Session Transfer Pattern<br>3.3. Examples of Cross-Device Flows<br>3.3.1. Example A1: Authorize Access to a Video Streaming<br>Service (User-Transferred Session Data Pattern)<br>3.3.2. Example A2: Authorize Access to Productivity Services<br>(User-Transferred Session Data Pattern)<br>3.3.3. Example A3: Authorize Use of a Bike Sharing Scheme<br>(User-Transferred Session Data Pattern)<br>3.3.4. Example A4: Authorize a Financial Transaction<br>(Backchannel-Transferred Session Pattern)<br>3.3.5. Example A5: Add a Device to a Network (Cross-Device<br>Session Transfer Pattern)<br>3.3.6. Example A6: Remote Onboarding (User-Transferred Session<br>Data Pattern)<br>3.3.7. Example A7: Application Bootstrap (Cross-Device Session<br>Transfer Pattern)<br>3.3.8. Example A8: Access a Productivity Application<br>(User-Transferred Authorization Data Pattern)<br>3.3.9. Example A9: Administer a System<br>(Backchannel-Transferred Session Pattern)<br>4. Cross-Device Flow Exploits<br>4.1. Cross-Device Authorization Flow Exploits<br>4.1.1. User-Transferred Session Data Pattern Exploits<br>4.1.2. Backchannel-Transferred Session Pattern Exploits<br>4.1.3. User-Transferred Authorization Data Pattern Exploits<br>4.2. Cross-Device Session Transfer Exploits<br>4.3. Examples of Cross-Device Flow Exploits<br>4.3.1. Example B1: Illicit Access to a Video Streaming Service<br>(User-Transferred Session Data Pattern)<br>4.3.2. Example B2: Illicit Access to Productivity Services<br>(User-Transferred Session Data Pattern)<br>4.3.3. Example B3: Illicit Access to Physical Assets<br>(User-Transferred Session Data Pattern)<br>4.3.4. Example B4: Illicit Transaction Authorization<br>(Backchannel-Transferred Session Pattern)<br>4.3.5. Example B5: Illicit Network Join (Cross-Device Session<br>Transfer Pattern)<br>4.3.6. Example B6: Illicit Onboarding (User-Transferred<br>Session Data Pattern)<br>4.3.7. Example B7: Illicit Application Bootstrap...