DPoP (Demonstrating Proof of Possession)
O que é DPoP (Demonstrating Proof of Possession)?
DPoP (Demonstrating Proof of Possession)An OAuth 2.0 extension (RFC 9449) that binds access tokens to a per-client key pair, so a stolen bearer token cannot be replayed by an attacker without also stealing the private signing key.
DPoP (Demonstrating Proof of Possession at the Application Layer), specified in RFC 9449, is an OAuth 2.0 mechanism that converts bearer tokens into sender-constrained tokens without requiring mutual TLS. The client generates an ephemeral asymmetric key pair, includes the public key's JWK thumbprint as `jkt` in the access token (issued by the IdP), and on every API call sends a short-lived JWT proof signed with its private key in the `DPoP` HTTP header. The proof commits to the HTTP method, the request URI, and a fresh nonce or jti, so an attacker who steals the access token but lacks the private key cannot forge a valid proof. Resource servers verify the proof matches both the token's bound key and the current request. DPoP is one of two practical answers to OAuth bearer-token theft (the other being mTLS-bound tokens) and is now widely supported by Okta, Auth0, Entra ID, Keycloak, and several open-source libraries. Combined with PKCE and short refresh-token lifetimes, DPoP dramatically reduces the value of a stolen token to an attacker.
● Exemplos
- 01
A mobile banking app signs a DPoP proof JWT with its TEE-stored key on every API call; a stolen access token alone gets the attacker nothing.
- 02
An IdP issues access tokens with `cnf.jkt` bound to the client's DPoP key, and the resource server rejects any request whose proof JWT doesn't match the bound thumbprint.
● Perguntas frequentes
O que é DPoP (Demonstrating Proof of Possession)?
An OAuth 2.0 extension (RFC 9449) that binds access tokens to a per-client key pair, so a stolen bearer token cannot be replayed by an attacker without also stealing the private signing key. Pertence à categoria Identidade e acesso da cibersegurança.
O que significa DPoP (Demonstrating Proof of Possession)?
An OAuth 2.0 extension (RFC 9449) that binds access tokens to a per-client key pair, so a stolen bearer token cannot be replayed by an attacker without also stealing the private signing key.
Como funciona DPoP (Demonstrating Proof of Possession)?
DPoP (Demonstrating Proof of Possession at the Application Layer), specified in RFC 9449, is an OAuth 2.0 mechanism that converts bearer tokens into sender-constrained tokens without requiring mutual TLS. The client generates an ephemeral asymmetric key pair, includes the public key's JWK thumbprint as `jkt` in the access token (issued by the IdP), and on every API call sends a short-lived JWT proof signed with its private key in the `DPoP` HTTP header. The proof commits to the HTTP method, the request URI, and a fresh nonce or jti, so an attacker who steals the access token but lacks the private key cannot forge a valid proof. Resource servers verify the proof matches both the token's bound key and the current request. DPoP is one of two practical answers to OAuth bearer-token theft (the other being mTLS-bound tokens) and is now widely supported by Okta, Auth0, Entra ID, Keycloak, and several open-source libraries. Combined with PKCE and short refresh-token lifetimes, DPoP dramatically reduces the value of a stolen token to an attacker.
Como se defender contra DPoP (Demonstrating Proof of Possession)?
As defesas contra DPoP (Demonstrating Proof of Possession) costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para DPoP (Demonstrating Proof of Possession)?
Nomes alternativos comuns: RFC 9449, Demonstrating Proof of Possession.
● Termos relacionados
- identity-access№ 839
OAuth 2.0
Framework aberto de autorização que permite ao dono de um recurso conceder a uma aplicação terceira acesso limitado a uma API sem partilhar credenciais.
- identity-access№ 642
JWT (JSON Web Token)
Formato de token compacto e seguro para URL (RFC 7519) que transporta claims JSON assinadas; usado como access token, ID token e contentor de sessao.
- identity-access№ 928
PKCE (Proof Key for Code Exchange)
An OAuth 2.0 extension (RFC 7636) that binds an authorization-code redemption to a one-time secret created by the client, neutralizing authorization-code interception attacks on public and confidential clients alike.
- identity-access№ 104
Bearer Token (token ao portador)
Credencial opaca ou estruturada (RFC 6750) que concede acesso a um recurso apenas por posse, sem prova de que o portador e o legitimo dono.
- network-security№ 797
TLS mútuo (mTLS)
Extensão do TLS em que tanto o cliente como o servidor apresentam certificados X.509 para se autenticarem mutuamente de forma criptográfica.
- identity-access№ 852
OpenID Connect (OIDC)
Camada de identidade construída sobre OAuth 2.0 que permite aos clientes verificar a identidade de um utilizador e obter dados básicos de perfil através de ID tokens assinados.