OAuth and the long way to Proof of Possession
summary
OAuth lacked cryptographic binding for a decade and now two practical options exist: mutual TLS and DPoP proof JWT. Mutual TLS binds tokens by embedding an x509 thumbprint (CNF claim, SHA‑256) into the access token — it works but requires PKI, client certs and infrastructure. DPoP has the client generate a keypair, send a JWK in a DPoP header, and the AS embeds the JWK thumbprint in the token; APIs check jti/IAT replay windows and sign method+URL. Microsoft uses DPoP privately; browsers and XSS remain unsolved.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:50High Security OAuth
- 5:10OAuth Bearer Tokens
- 7:56WS-Security Proof of Possession
- 11:50What about OAuth 1.0?
- 17:39Attempt #2: Token Binding
- 26:49Example Access Token
- 27:25Creating an X.509 Client Certificate
- 30:03MTLS Summary
- 34:57DPop Proof Token (Token Request)
- 38:20DPOP Proof Token (Resource Access)
related talks
47mOAuth and Proof of Possession - The long way round
18mSafeguarding Web Applications Against Token Theft: Fortifying Security and Trust
01h 02mOAuth in 2021 – What’s up?
46mA Deep Dive into the Past, Present & Future of OAuth
01h 00mSupercharging OAuth 2.0 Security
46mBearer of Good News
20mOAuth 2.0 and the Internet of Things (IoT)
30mInsecurity protocols: an overview of modern authentication