IETF · October 2017
RFC 8252 (BCP 212)
W. Denniss, J. Bradley
Human-in-the-loop consent for a local agent often looks like this RFC, not like a server-side redirect. Loopback + PKCE is the usual pattern for CLI agents.
At a glance
Actors
01
RFC 8252 (BCP 212) is how a native app completes authorization code via the system browser with PKCE and claimed HTTPS or loopback redirects. Human-in-the-loop consent for a local agent often looks like this RFC, not like a server-side redirect.
The agent is not the embedded WebView. Embedded WebViews are in-scope for attackers (credential phishing, cookie theft). CLI agents should use loopback + PKCE or a remote BFF.
02
The OS browser is the trusted user-agent for authentication. The app is a public client. Custom URI schemes are weaker than claimed HTTPS URLs because any app can register them on some platforms.
03
Open the system browser to the authorization endpoint. Receive the code on https app links or http://127.0.0.1:{port}/callback. Exchange with PKCE. Do not intercept cookies in an embedded view. OAuth 2.1 cites this RFC as part of the consolidation.
04
Flow 1
Agent binds 127.0.0.1 to an ephemeral port and generates PKCE.
Opens the system browser to the AS authorize URL.
User authenticates and consents. Redirect hits loopback with the code.
Agent exchanges code+verifier on the back channel. Stores tokens outside the model context.
05
Authorization UX for clients that are not servers. User authentication still happens at the AS (OIDC). The native app is the OAuth client.
06
Native-app profile is an input to 2.1. Loopback port exception for redirect matching lives there.
Required.
Sibling BCP for code that runs in the browser rather than as an OS app.
If there is no local browser, CIBA is the alternative HITL path.
07
8252 tells you not to. Agent 'login in the electron pane' is often a WebView.
Prefer claimed HTTPS URIs. Custom schemes are interceptable.
08
RFC 8252 (BCP 212), October 2017. Stable. https://www.rfc-editor.org/rfc/rfc8252.html
Do not use custom URI schemes if HTTPS app links / claimed HTTPS URIs are available. Embedded webviews are in-scope for attackers.