Glossary

DPoP

Demonstrating Proof of Possession

An OAuth client signs a short-lived proof JWT for each request with its own private key, and the authorization server binds the tokens it issues to that key, so a stolen access or refresh token is useless without the key.

Defined in: RFC 9449

Covered in

Guide

Defend OAuth and OIDC against redirect and token attacks

Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.

Practice: OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE