IETF · August 2026
RFC 10017 (BCP 212)
A. Parecki, D. Waite, P. De Ryck
Chat UIs that broker agent OAuth in the browser are browser-based OAuth clients. XSS in the chat page is equivalent to stealing the agent's tokens.
At a glance
Actors
01
RFC 10017 (BCP 212, August 2026) is the SPA story: code in the browser cannot hide a client secret or reliably hide tokens from XSS. Chat UIs that broker agent OAuth in the browser are browser-based OAuth clients. XSS in the chat page is equivalent to stealing the agent's tokens.
OAuth 2.1 draft-16 still TODOs importing this text and cites the -27 Internet-Draft (6 July 2026). The RFC itself is published — use the RFC.
02
The browser is hostile: XSS, malicious extensions, referrers. A Backend-for-Frontend that holds tokens in HTTP-only cookies moves the trust boundary to your server. Browser-only + PKCE keeps tokens in memory at best; localStorage is a gift to XSS.
03
Authorization code + PKCE. Prefer BFF. If tokens must live in the browser, keep them in memory. Implicit is forbidden. CORS must be set on token and other AS endpoints the SPA calls; not on the authorization endpoint (that is a redirect).
04
Flow 1
Browser talks only to your BFF with session cookies.
BFF performs authorization code + PKCE as a confidential client.
BFF calls MCP/SaaS APIs with the access token. The model never sees the token.
This is the architecture that makes prompt injection unable to exfiltrate the Bearer token — it never entered the browser or the prompt.
05
Authorization for public clients in the browser. Complements OIDC for SPAs. Does not define agent identity.
06
Input document; 2.1 has not finished copying the normative text as of -16.
Required for the browser-only pattern.
Same threat family: XSS, leakage, mix-up.
If the MCP client is a browser app, this BCP applies to how it holds tokens.
07
XSS reads them. Memory-only or BFF.
FAPI and this BCP want redirects, not XHR, to the authorization endpoint.
08
RFC 10017 (BCP 212), August 2026, A. Parecki, D. Waite, P. De Ryck. Newly stable RFC. https://www.rfc-editor.org/rfc/rfc10017.html
OAuth 2.1 draft-16 still had a TODO to import this text; the RFC itself published in August 2026. Confirm the RFC Editor page for the exact author list if citing academically.