OAuth and Proof of Possession - The long way round
summary
OAuth finally gets sender-constrained tokens in two concrete ways: mutual TLS (speced 2020) binds an access token via the CNF x5t#S256 thumbprint to a client certificate and works in intranets and banking but needs PKI and reverse-proxy support; dpop header (new RFC entering editor) uses short‑lived JWT “proof tokens” with a JWK thumbprint (jkt) that sign method+URL, forces a per-request proof token (≈60s lifetime) and replay caches, and is implemented in some .NET libraries and IdentityServer.
AI-written summary · about
chapters (26)
- 0:00Intro
- 2:14OAuth
- 7:31Proof of Possession before OAuth
- 9:57OAuth 10 version 1
- 11:51OAuth 10 version 2
- 13:34New OAuth hashtag
- 13:55The last passing gift
- 14:49OAuth Proof of Possession
- 16:10OAuth Token Binding
- 17:44The Industry Jumps In
- 19:18OAuth 20 Mutual TLS
- 20:07Mutual TLS
- 20:37Mutual TLS in practice
- 22:00CNF token
- 23:08Client certificate
- 24:51Summary
- 25:27Fast forwarding
- 27:41Token request
- 28:06Proof token
- 29:54Access token
- 30:26Resource access
- 30:54Json token
- 31:40Token hash
- 32:35Demo
- 36:39The downside of Depop
- 39:04Questions
