%% You should probably cite rfc7636 instead of this I-D. @techreport{ietf-oauth-spop-09, number = {draft-ietf-oauth-spop-09}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-ietf-oauth-spop/09/}, author = {Nat Sakimura and John Bradley and Naveen Agarwal}, title = {{Proof Key for Code Exchange by OAuth Public Clients}}, pagetotal = 18, year = 2015, month = feb, day = 4, abstract = {OAuth 2.0 public clients utilizing the Authorization Code Grant are susceptible to the authorization code interception attack. This specification describes the attack as well as a technique to mitigate against the threat.}, }