OAuth 2.0 Demonstrating Proof of Possession (DPoP), September 2023
- File formats:
- Also available: XML file for editing
- PROPOSED STANDARD
- D. Fett
- oauth (sec)
Discuss this RFC: Send questions or comments to the mailing list [email protected]
This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.
For the definition of Status, see RFC 2026.
For the definition of Stream, see RFC 8729.