Support OAuth 2.1

[Avantol13]

Is your feature request related to a problem? Please describe.

Model Context Protocol (MCP) is growing in popularity and recommends the use of OAuth 2.1. We use authlib in our production open-source biomedical data platform Gen3 and we'd like to continue using it while considering early adoption of OAuth 2.1 https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html

Describe the solution you'd like

Client and server support for OAuth 2.1 compliance.

Describe alternatives you've considered

Not adopt it or update existing 2.0 client/server

Additional context

There don't appear to be that many huge changes. It honestly seems like a consolidation of the various RFCs since OAuth 2 and removal of insecure options. Differences with 2: https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-10

[azmeuk]

On the server side I suppose this can be implemented as an AuthorizationServer extension that would simply disable the deprecated features, and enforce PKCE.

[yannj-fr]

Agree with @azmeuk , I am currently updating the python-sdk from MCP to support Authlib as a backend. Current version of Oauth 2.1 is mostly compatible with Authlib on server side.

As a reminder :

The major differences from OAuth 2.0 are listed below.

PKCE is required for all OAuth clients using the authorization code flow Redirect URIs must be compared using exact string matching The Implicit grant (response_type=token) is omitted from this specification The Resource Owner Password Credentials grant is omitted from this specification Bearer token usage omits the use of bearer tokens in the query string of URIs Refresh tokens for public clients must either be sender-constrained or one-time use The definitions of public and confidential clients have been simplified to only refer to whether the client has credentials

What could be done is to add a flag enforceOauth21 to forbid some lower security. WDYT @azmeuk @lepture ?

[lepture]

It is already working if you don't include these grant types:

• The Implicit grant (response_type=token) is omitted from this specification
• The Resource Owner Password Credentials grant is omitted from this specification

These are controlled by your implementation:

• PKCE is required for all OAuth clients using the authorization code flow: https://github.com/authlib/authlib/blob/main/authlib/oauth2/rfc7636/challenge.py#L43
• Redirect URIs must be compared using exact string matching:
  https://github.com/authlib/authlib/blob/main/authlib/oauth2/rfc6749/models.py#L57
• Refresh tokens for public clients must either be sender-constrained or one-time use: https://github.com/authlib/authlib/blob/c9890da9d1f1d5fd7bf551e7cd28facfc64e9b7d/authlib/oauth2/rfc6749/grants/refresh_token.py#L34