OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) (2023)
DPoP (Demonstrating Proof-of-Possession) is an OAuth 2.0 extension that enables a token sender to prove possession of a private key, binding access and refresh tokens to a public key to prevent misuse from token theft and replay attacks.
Background
- OAuth 2.0 is the standard framework that lets users grant third-party apps access to their online accounts (e.g., "Sign in with Google") without sharing their password. It works via short-lived "access tokens" the app presents to the service.
- DPoP (Demonstrating Proof-of-Possession) is an extension that binds an OAuth access token to a specific client device. Without DPoP, if a token is stolen or leaked, an attacker can use it from any machine.
- DPoP adds a cryptographic key pair on the client: the app signs each request with its private key, and the server verifies the signature against the public key registered when the token was issued.
- This prevents token theft from being useful to an attacker who does not possess the private key, even if they intercept the token itself.
- The spec was developed by the IETF OAuth working group (published 2023) to address a long-recognized gap in OAuth security, particularly for high-value APIs in finance, health, and enterprise settings.