{"id":2417,"date":"2023-09-07T17:16:47","date_gmt":"2023-09-08T00:16:47","guid":{"rendered":"https:\/\/self-issued.info\/?p=2417"},"modified":"2025-05-20T09:35:22","modified_gmt":"2025-05-20T16:35:22","slug":"oauth-2-0-demonstrating-proof-of-possession-dpop-is-now-rfc-9449","status":"publish","type":"post","link":"https:\/\/self-issued.info\/?p=2417","title":{"rendered":"OAuth 2.0 Demonstrating Proof of Possession (DPoP) is now RFC 9449"},"content":{"rendered":"<p><span class=\"plain\"><img decoding=\"async\" align=\"right\" alt=\"OAuth logo\" src=\"https:\/\/self-issued.info\/images\/oauth_logo_120x120.png\" \/><\/span>The OAuth 2.0 Demonstrating Proof of Possession (DPoP) specification has been published as <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc9449.html\">RFC 9449<\/a>! As <a href=\"https:\/\/twitter.com\/vibronet\/status\/1652088407445872640\">Vittorio Bertocci wrote<\/a>, &#8220;One of the specs with the highest potential for (positive) impact in recent years.&#8221;  I couldn&#8217;t agree more!<\/p>\n<p>The concise abstract says it all:<\/p>\n<blockquote><p>\nThis document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.<\/p><\/blockquote>\n<p>As I described in my <a href=\"https:\/\/self-issued.info\/?p=2278\">2022 Identiverse presentation on DPoP<\/a> it&#8217;s been a Long and Winding Road to get here.  Efforts at providing practical proof of possession protection for tokens have included:<\/p>\n<ul>\n<li>SAML 2.0 Holder-of-Key Assertion Profile \u2013 Not exactly OAuth<\/li>\n<li>OAuth 1.0 used PoP \u2013 But message signing too complicated<\/li>\n<li>OAuth 2.0 MAC draft \u2013 Used similarly complicated signing<\/li>\n<li>OAuth 2.0 HTTP Signing draft \u2013 Abandoned due to complexity<\/li>\n<li>TLS Token Binding \u2013 Some browsers declined to ship it<\/li>\n<li>OAuth 2.0 Mutual TLS \u2013 Client certs notoriously difficult to use<\/li>\n<li>OAuth 2.0 DPoP \u2013 Today&#8217;s RFC aimed at simply and practically solving this important problem<\/li>\n<\/ul>\n<p>As they say, I think this one&#8217;s the one!  Implement, deploy, and enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The OAuth 2.0 Demonstrating Proof of Possession (DPoP) specification has been published as RFC 9449! As Vittorio Bertocci wrote, &#8220;One of the specs with the highest potential for (positive) impact in recent years.&#8221; I couldn&#8217;t agree more! The concise abstract says it all: This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32,26,25],"tags":[],"class_list":["post-2417","post","type-post","status-publish","format-standard","hentry","category-ietf","category-oauth","category-specifications"],"_links":{"self":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2417"}],"version-history":[{"count":3,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2417\/revisions"}],"predecessor-version":[{"id":2703,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2417\/revisions\/2703"}],"wp:attachment":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}