%% You should probably cite rfc7636 instead of this I-D. @techreport{ietf-oauth-spop-06, number = {draft-ietf-oauth-spop-06}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-oauth-spop/06/}, author = {Nat Sakimura and John Bradley and Naveen Agarwal}, title = {{Proof Key for Code Exchange by OAuth Public Clients}}, pagetotal = 16, year = 2015, month = jan, day = 22, abstract = {OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat.}, }