OAuth 2.0 Demonstrating Proof of Possession (DPoP)

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 39
Abstract: This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.
Publication Date: 2023-09-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9449
Link: https://doi.org/10.17487/RFC9449
Author(s): Daniel Fett
Brian Campbell
John Bradley
Torsten Lodderstedt
Michael B. Jones
David Waite
Keyword(s): Security, OAuth

Latest version of IETF RFC 9449

Document Versions — IETF RFC 9449

▶ IETF RFC 9449 (2023-09-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST FIPS 180-4 [Active]
IETF RFC 2119 [Active*]
IETF RFC 3986 [Active, Amended*]
IETF RFC 5234 [Active, Amended*]
IETF RFC 6125 [Superseded*]
IETF RFC 6749 [Active*]
IETF RFC 6750 [Active*]
IETF RFC 7515 [Active*]
IETF RFC 7517 [Active*]
IETF RFC 7519 [Active*]
IETF RFC 7638 [Active*]
RFC7800 — RFC7800 EXTERNAL
IETF RFC 8174 [Active*]

Bibliographic Reference(s)

IETF.draft-ietf-oauth-security-topics-23 — I-D.ietf-oauth-security-topics EXTERNAL
IETF.draft-ietf-oauth-token-binding-08 — I-D.ietf-oauth-token-binding EXTERNAL
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 1", November 2014, <https://openid.net/specs/openid-connect-core-1_0.html>. EXTERNAL
IANA, "JSON Web Token Claims", <https://www.iana.org/assignments/jwt/>. EXTERNAL
CVE, "CVE-2013-3587", <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587>. EXTERNAL
Hanley, M., "Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators", April 2022, <https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/>. EXTERNAL
IANA, "Media Types", <https://www.iana.org/assignments/media-types/>. EXTERNAL
IANA, "Hypertext Transfer Protocol (HTTP) Authentication Scheme Registry", <https://www.iana.org/assignments/http-authschemes/>. EXTERNAL
Graham-Cumming, J., "Incident report on memory leak caused by Cloudflare parser bug", February 2017, <https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/>. EXTERNAL
IANA, "JSON Web Signature and Encryption Algorithms", <https://www.iana.org/assignments/jose/>. EXTERNAL
IANA, "Hypertext Transfer Protocol (HTTP) Field Name Registry", <https://www.iana.org/assignments/http-fields/>. EXTERNAL
"CVE-2014-0160", <https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0160>. EXTERNAL
IANA, "OAuth Parameters", <https://www.iana.org/assignments/oauth-parameters/>. EXTERNAL
CVE, "CVE-2012-4929", <https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4929>. EXTERNAL
IETF RFC 2046 [Active, Amended*]
IETF RFC 4122 [Superseded*]
IETF RFC 4949 [Active*]
IETF RFC 6838 [Active*]
IETF RFC 7523 [Active*]
IETF RFC 7591 [Active*]
IETF RFC 7636 [Active*]
IETF RFC 7662 [Active*]
IETF RFC 8414 [Active*]
IETF RFC 8705 [Active*]
IETF RFC 8707 [Active*]
IETF RFC 8725 [Active*]
IETF RFC 8792 [Active*]
IETF RFC 9110 [Active*]
IETF RFC 9126 [Active*]
W3C.csp3 — W3C.CSP EXTERNAL
W3C.webcryptoapi.20170126 — webcrypto EXTERNAL
WHATWG.FETCH — WHATWG, “Fetch,” Living Standard, Aug. 2023, Available: https://fetch.spec.whatwg.org/. EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9449.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP). Available at https://doi.org/10.17487/RFC9449

Snippet:

IETF RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP). Available at https://doi.org/10.17487/RFC9449

HTML (ISO 690 compliant)

Preview:

IETF RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP). Available at https://doi.org/10.17487/RFC9449

Snippet:

<span class="citation"><cite>IETF RFC 9449</cite>, OAuth 2.0 Demonstrating Proof of Possession (DPoP). Available at <a href="https://doi.org/10.17487/RFC9449" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9449</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP)
doi: 10.17487/RFC9449
url: https://doi.org/10.17487/RFC9449

Snippet:

<li>
<cite id="bib-rfc9449">IETF RFC 9449</cite>, OAuth 2.0 Demonstrating Proof of Possession (DPoP)
<span class="doi">10.17487/RFC9449</span>
</li>

Referenced By

IETF RFC 9700 [Active*]