%% You should probably cite rfc7636 instead of this I-D. @techreport{ietf-oauth-spop-02, number = {draft-ietf-oauth-spop-02}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-oauth-spop/02/}, author = {Nat Sakimura and John Bradley and Naveen Agarwal}, title = {{Symmetric Proof of Possession for the OAuth Authorization Code Grant}}, pagetotal = 10, year = 2014, month = oct, day = 27, abstract = {The OAuth 2.0 public client utilizing Authorization Code Grant (RFC 6749 - 4.1) is susceptible to the code interception attack. This specification describes a mechanism that acts as a control against this threat.}, }