What are the differences between OAuth 2.0 and 2.1?

Question

I was just looking at Spring Authorization Server and noticed that it mentions OAuth 2.1.

What are the differences between OAuth 2.0 and 2.1?

Answer 1

The OAuth 2.1 specification is currently in draft state. Because of that it currently not clear what will be the final differences.

See current draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-05

Excerpt from the current draft:

This draft consolidates the functionality in OAuth 2.0 [RFC6749], OAuth 2.0 for Native Apps ([RFC8252]), Proof Key for Code Exchange ([RFC7636]), OAuth 2.0 for Browser-Based Apps ([I-D.ietf-oauth-browser-based-apps]), OAuth Security Best Current Practice ([I-D.ietf-oauth-security-topics]), and Bearer Token Usage ([RFC6750]).

Where a later draft updates or obsoletes functionality found in the original [RFC6749], that functionality in this draft is updated with the normative changes described in a later draft, or removed entirely.

A non-normative list of changes from OAuth 2.0 is listed below:

• The authorization code grant is extended with the functionality from PKCE ([RFC7636]) such that the default method of using the authorization code grant according to this specification requires the addition of the PKCE parameters

• Redirect URIs must be compared using exact string matching as per Section 4.1.3 of [I-D.ietf-oauth-security-topics]

• The Implicit grant (response_type=token) is omitted from this specification as per Section 2.1.2 of [I-D.ietf-oauth-security-topics]

• The Resource Owner Password Credentials grant is omitted from this specification as per Section 2.4 of [I-D.ietf-oauth-security-topics]

• Bearer token usage omits the use of bearer tokens in the query string of URIs as per Section 4.3.2 of [I-D.ietf-oauth-security-topics]

• Refresh tokens for public clients must either be sender- constrained or one-time use as per Section 4.12.2 of [I-D.ietf-oauth-security-topics]

See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-05#section-10