How to Secure OAuth 2.0 in Production

OAuth 2.0 has evolved fast. RFC 9700 (Jan 2025) codifies security requirements that didn't exist when most tutorials were written: implicit flow and ROPC are officially dead, PKCE is mandatory, and redirect URIs need exact string matching with no wildcards.

The post covers the attacks these rules prevent: code interception on mobile (PKCE fixes it), token leakage via Referer headers and URL fragments (why implicit died), and subdomain takeover through wildcard redirect URIs. For browser token storage, the BFF pattern keeps tokens server-side so XSS can't steal them. Refresh token rotation with reuse detection catches stolen tokens by revoking entire session families.

Practical Node.js snippets show PKCE generation, JWT validation on a resource server, and state parameter CSRF prevention. Everything maps to specific RFC 9700 sections you can reference.