DPoP binds OAuth tokens to proof of key possession, adding a constraint against token copying alone.
Evaluation approach
Validate proof, target request and token binding on the server. Include replay and timing requirements.
Application example
Proof for another request must not be valid here. Plan key replacement and lost-device handling.
Limits and considerations
If both the token and key use are compromised, important limits remain.
How does rotation affect the session?
Register replacement keys deliberately while preserving token binding. Define old-key validity rather than treating both keys as interchangeable indefinitely.
Checks and decisions
- Verify request binding
- Control replay
- Plan key transitions
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.