The OAuth 2.0 Demonstrating Proof of Possession (DPoP) specification has been published as RFC 9449! As Vittorio Bertocci wrote, “One of the specs with the highest potential for (positive) impact in recent years.” I couldn’t agree more!
The concise abstract says it all:
This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.
As I described in my 2022 Identiverse presentation on DPoP it’s been a Long and Winding Road to get here. Efforts at providing practical proof of possession protection for tokens have included:
- SAML 2.0 Holder-of-Key Assertion Profile – Not exactly OAuth
- OAuth 1.0 used PoP – But message signing too complicated
- OAuth 2.0 MAC draft – Used similarly complicated signing
- OAuth 2.0 HTTP Signing draft – Abandoned due to complexity
- TLS Token Binding – Some browsers declined to ship it
- OAuth 2.0 Mutual TLS – Client certs notoriously difficult to use
- OAuth 2.0 DPoP – Today’s RFC aimed at simply and practically solving this important problem
As they say, I think this one’s the one! Implement, deploy, and enjoy!
Leave a Reply
You must be logged in to post a comment.