RFC9700: Best Current Practice for OAuth 2.0 Security
rfc-editor.org