{
  "number": 10027,
  "title": "Best Current Practice for Security of Cross-Device Flows",
  "authors": [
    "P. Kasselman",
    "D. Fett",
    "F. Skokan"
  ],
  "published": "2026-08",
  "status": "Best Current Practice",
  "stream": "IETF",
  "area": "sec",
  "working_group": "oauth",
  "pages": 50,
  "formats": [
    "HTML",
    "TXT",
    "PDF",
    "XML"
  ],
  "abstract": "This document describes threats against cross-device flows along with practical mitigations, protocol selection guidance, and a summary of formal analysis results identified as relevant to the security of cross-device flows. It serves as a security guide to system designers, architects, product managers, security specialists, fraud analysts, and engineers implementing cross-device flows.",
  "keywords": [
    "security",
    "oauth2"
  ],
  "draft": "draft-ietf-oauth-cross-device-security-16",
  "doi": "10.17487/RFC10027",
  "is_also": [
    "BCP247"
  ],
  "urls": {
    "html": "https://rfc.dk/rfc10027/",
    "text": "https://rfc.dk/rfc10027.txt",
    "rfc_editor": "https://www.rfc-editor.org/rfc/rfc10027",
    "datatracker": "https://datatracker.ietf.org/doc/rfc10027/"
  },
  "text_modified": "2026-08-11T23:17:07.251157045Z"
}