RFC 9700 Quiz

Q1: How should an authorization server compare a registered redirect URI with the request value?

Multiple Choice

A. Use exact string matching except for the defined localhost port exception B. Accept any URI under the same top-level domain C. Use a substring match on the registered path

**Explanation:** A: Exact matching prevents attacker-controlled URI variations from receiving authorization responses. B: Domain-level matching is too broad and can include attacker-controlled hosts or paths. C: Substring comparison admits unintended redirect targets.

Q2: Why is PKCE important for authorization code flows?

Multiple Choice

A. It encrypts every access token stored by the client B. It binds code redemption to the client instance that created the challenge C. It replaces redirect URI validation

**Explanation:** A: PKCE binds code redemption to a verifier and is not storage encryption. B: An intercepted code is not redeemable without the corresponding code verifier. C: PKCE and exact redirect matching address different attack paths and are both needed.

Q3: What is RFC 9700's position on the Resource Owner Password Credentials grant?

Multiple Choice

A. Use it whenever a client cannot open a browser B. Use it only with long-lived refresh tokens C. It must not be used

**Explanation:** A: Browser constraints do not remove the credential exposure and phishing risks. B: Refresh-token lifetime does not fix collection of the resource owner's password. C: RFC 9700 prohibits this grant because it exposes credentials and is incompatible with stronger authentication.

Q4: Why should clients generally avoid the implicit grant response?

Multiple Choice

A. Access tokens in the authorization response are more exposed to leakage and replay B. Implicit responses always use stronger sender-constrained tokens C. Implicit responses require exact redirect matching while code flows do not

**Explanation:** A: The authorization code flow allows stronger binding and token-endpoint protections. B: The response type does not automatically sender-constrain the token. C: Exact redirect URI checks are important for both flows.

Q5: A client supports multiple authorization servers. Which control helps prevent mix-up attacks?

Multiple Choice

A. Select the server from an untrusted response parameter after token exchange B. Use issuer identification or distinct redirect URIs and validate the binding C. Reuse one state value for all simultaneous authorization requests

**Explanation:** A: A late untrusted choice lets an attacker confuse endpoint and issuer relationships. B: These mechanisms let the client detect a response from the wrong authorization server. C: Reusing correlation values weakens response-to-request binding.

Q6: A public client receives refresh tokens. Which replay defense should the authorization server use?

Multiple Choice

A. Rely only on the client_id value B. Make refresh tokens permanent so replacements are unnecessary C. Use sender-constrained refresh tokens or refresh-token rotation

**Explanation:** A: Client identifiers are not secrets and do not detect refresh-token replay. B: Longer validity increases the harm of token theft. C: These mechanisms prevent or detect replay of stolen refresh tokens.

Q7: What is the purpose of sender-constraining access tokens?

Multiple Choice

A. Limit use of a stolen token to a presenter that proves possession of the bound key B. Allow the token to be sent over plaintext HTTP without server authentication C. Make audience and resource-server validation unnecessary for every token

**Explanation:** A: The additional proof makes a copied token alone insufficient. B: Sender constraining does not replace TLS confidentiality and server authentication. C: A key-bound token can still be presented to the wrong resource if audience checks are omitted.

Q8: Why must clients and authorization servers avoid open redirectors?

Multiple Choice

A. They prevent token endpoints from using TLS and validating their server certificates B. They can forward authorization codes or tokens to an attacker-controlled URI C. They force every OAuth client to become confidential and hold a static secret

**Explanation:** A: Open redirects concern destination control and are not a TLS capability limitation. B: An open redirect can turn an otherwise trusted URI into a redirect trampoline. C: Client type is independent of whether a redirect endpoint is open.

Q9: A valid authorization code is presented by the wrong client or with the wrong redirect URI. What should the token endpoint do?

Multiple Choice

A. Issue a token but reduce its scope B. Ask the resource server to decide later C. Reject the redemption request

**Explanation:** A: Scope reduction does not repair a broken client or redirect binding. B: The token endpoint must reject invalid code redemption before issuing a token. C: Authorization codes are bound to the client and redirect context used in the authorization request.

Q10: How should an A2A deployment apply RFC 9700 to OAuth support?

Multiple Choice

A. Advertise OAuth 2.0 and leave all flow and replay choices implicit B. Profile allowed flows, redirect checks, PKCE, token binding, and refresh-token handling C. Treat TLS alone as protection against every OAuth attack

**Explanation:** A: Unspecified choices lead to inconsistent and potentially obsolete security profiles. B: A deployment profile must turn the BCP's controls into interoperable endpoint behavior. C: TLS does not prevent code injection, mix-up, redirect abuse, or stolen-token replay by itself.

Current OAuth threat mitigations and deployment choices

References

Q1: How should an authorization server compare a registered redirect URI with the request value?

Q2: Why is PKCE important for authorization code flows?

Q3: What is RFC 9700's position on the Resource Owner Password Credentials grant?

Q4: Why should clients generally avoid the implicit grant response?

Q5: A client supports multiple authorization servers. Which control helps prevent mix-up attacks?

Q6: A public client receives refresh tokens. Which replay defense should the authorization server use?

Q7: What is the purpose of sender-constraining access tokens?

Q8: Why must clients and authorization servers avoid open redirectors?

Q9: A valid authorization code is presented by the wrong client or with the wrong redirect URI. What should the token endpoint do?

Q10: How should an A2A deployment apply RFC 9700 to OAuth support?