topic
Verified 2026-09-18Demonstrating Proof of Possession (DPoP)
DPoP binds an OAuth access token to a sender-held private key and signs each HTTP request with a proof JWT.
Validate the proof signature, nonce when required, method, URI, issued-at time, unique identifier, and token key binding. DPoP limits replay of a stolen token but does not remove the need for TLS or secure key storage.
httpauthsecurityoauthauthentication
Reference (http)
DPoP: eyJ... Authorization: DPoP eyJ-access-token...
Validate the proof signature, nonce when required, method, URI, issued-at time, unique identifier, and token key binding. DPoP limits replay of a stolen token but does not remove the need for TLS or secure key storage.
Common mistakes
- Checking only the access-token signature, failing to bind the proof to the exact method and URI, or allowing proof replay.