René's URL Explorer Experiment


Title: RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP) | RFC Editor

Open Graph Title: RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP) | RFC Editor

Description: This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.

Open Graph Description: This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens.

Keywords:

Mail addresses
mail@danielfett.de
bcampbell@pingidentity.com
ve7jtb@ve7jtb.com
torsten@lodderstedt.net
michael_b_jones@hotmail.com
david@alkaline-solutions.com

Opengraph URL: https://www.rfc-editor.org/info/rfc9449/

Generator: Nuxt

direct link

Domain: www.rfc-editor.org


Hey, it has address:
Daniel Fett
Authlete
Email:

og:imagehttps://www.rfc-editor.org/api/v1/meta-thumbnail/rfc9449.png
og:image:altRFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP). This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access and refresh tokens..
og:image:typeimage/png
og:image:width1200
og:image:height630
og:typearticle
article:modified_time2023-09-07
resource-timestamp:info-rfc94492026-07-18T03:47:45.573+00:00
citation_authorD. Waite
citation_doi10.17487/RFC9449
citation_pdf_urlhttps://www.rfc-editor.org/rfc/rfc9449.pdf
citation_publication_date2023/09/07
citation_technical_report_numberrfc9449
citation_titleOAuth 2.0 Demonstrating Proof of Possession (DPoP)

Links:

Skip to content https://www.rfc-editor.org/rfc/rfc9449#main
https://www.rfc-editor.org/
https://www.rfc-editor.org/search/
What is an RFC?https://www.rfc-editor.org/series/rfc/
How can I use RFCs?https://www.rfc-editor.org/series/rfc-use/
Tips for reading RFCshttps://www.rfc-editor.org/series/rfc-tips/
Browse all RFCshttps://www.rfc-editor.org/rfc-index/
Download RFCshttps://www.rfc-editor.org/series/rfc-download/
Errata in RFCshttps://www.rfc-editor.org/series/rfc-errata/
FAQhttps://www.rfc-editor.org/series/rfc-faq/
How to write an RFChttps://www.rfc-editor.org/authors/rfc-how-to/
Independent Submissionshttps://www.rfc-editor.org/authors/rfc-independent-submissions/
Style Guidehttps://www.rfc-editor.org/authors/rfc-style-guide/
RFC Publication Processhttps://authors.ietf.org/rfc-publication-process
Document Queuehttps://queue.rfc-editor.org
About RFC Editorhttps://www.rfc-editor.org/about/rfc-editor/
Reportshttps://www.rfc-editor.org/about/rpc-reports/
Privacy Statementhttps://www.ietf.org/privacy-statement/
Contacthttps://www.rfc-editor.org/about/contact/
https://www.rfc-editor.org/search/
What is an RFC?https://www.rfc-editor.org/series/rfc/
How can I use RFCs?https://www.rfc-editor.org/series/rfc-use/
Tips for reading RFCshttps://www.rfc-editor.org/series/rfc-tips/
Browse all RFCshttps://www.rfc-editor.org/rfc-index/
Download RFCshttps://www.rfc-editor.org/series/rfc-download/
Errata in RFCshttps://www.rfc-editor.org/series/rfc-errata/
FAQhttps://www.rfc-editor.org/series/rfc-faq/
How to write an RFChttps://www.rfc-editor.org/authors/rfc-how-to/
Independent Submissionshttps://www.rfc-editor.org/authors/rfc-independent-submissions/
Style Guidehttps://www.rfc-editor.org/authors/rfc-style-guide/
RFC Publication Processhttps://authors.ietf.org/rfc-publication-process
Document Queuehttps://queue.rfc-editor.org
About RFC Editorhttps://www.rfc-editor.org/about/rfc-editor/
Reportshttps://www.rfc-editor.org/about/rpc-reports/
Privacy Statementhttps://www.ietf.org/privacy-statement/
Contacthttps://www.rfc-editor.org/about/contact/
Searchhttps://www.rfc-editor.org/search/
Homehttps://www.rfc-editor.org/
Abstracthttps://www.rfc-editor.org/rfc/rfc9449#abstract
https://www.rfc-editor.org/rfc/rfc9449#section-abstract-1
Status of This Memohttps://www.rfc-editor.org/rfc/rfc9449#name-status-of-this-memo
https://www.rfc-editor.org/rfc/rfc9449#section-boilerplate.1-1
https://www.rfc-editor.org/rfc/rfc9449#section-boilerplate.1-2
https://www.rfc-editor.org/info/rfc9449https://www.rfc-editor.org/info/rfc9449
https://www.rfc-editor.org/rfc/rfc9449#section-boilerplate.1-3
Copyright Noticehttps://www.rfc-editor.org/rfc/rfc9449#name-copyright-notice
https://www.rfc-editor.org/rfc/rfc9449#section-boilerplate.2-1
https://trustee.ietf.org/license-infohttps://trustee.ietf.org/license-info
https://www.rfc-editor.org/rfc/rfc9449#section-boilerplate.2-2
1. https://www.rfc-editor.org/rfc/rfc9449#section-1
Introductionhttps://www.rfc-editor.org/rfc/rfc9449#name-introduction
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
https://www.rfc-editor.org/rfc/rfc9449#section-1-1
RFC8705https://www.rfc-editor.org/rfc/rfc9449#RFC8705
TOKEN-BINDINGhttps://www.rfc-editor.org/rfc/rfc9449#I-D.ietf-oauth-token-binding
https://www.rfc-editor.org/rfc/rfc9449#section-1-2
https://www.rfc-editor.org/rfc/rfc9449#section-1-3
1.1. https://www.rfc-editor.org/rfc/rfc9449#section-1.1
Conventions and Terminologyhttps://www.rfc-editor.org/rfc/rfc9449#name-conventions-and-terminology
RFC2119https://www.rfc-editor.org/rfc/rfc9449#RFC2119
RFC8174https://www.rfc-editor.org/rfc/rfc9449#RFC8174
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-1
RFC5234https://www.rfc-editor.org/rfc/rfc9449#RFC5234
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-2
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-3
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-4
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-5
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-1.1-6
2. https://www.rfc-editor.org/rfc/rfc9449#section-2
Objectiveshttps://www.rfc-editor.org/rfc/rfc9449#name-objectives
https://www.rfc-editor.org/rfc/rfc9449#section-2-1
CRIMEhttps://www.rfc-editor.org/rfc/rfc9449#CRIME
BREACHhttps://www.rfc-editor.org/rfc/rfc9449#BREACH
Heartbleedhttps://www.rfc-editor.org/rfc/rfc9449#Heartbleed
Cloudbleedhttps://www.rfc-editor.org/rfc/rfc9449#Cloudbleed
GitHub.Tokenshttps://www.rfc-editor.org/rfc/rfc9449#GitHub.Tokens
https://www.rfc-editor.org/rfc/rfc9449#section-2-2
SECURITY-TOPICShttps://www.rfc-editor.org/rfc/rfc9449#I-D.ietf-oauth-security-topics
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
RFC8707https://www.rfc-editor.org/rfc/rfc9449#RFC8707
https://www.rfc-editor.org/rfc/rfc9449#section-2-3
W3C.WebCryptoAPIhttps://www.rfc-editor.org/rfc/rfc9449#W3C.WebCryptoAPI
https://www.rfc-editor.org/rfc/rfc9449#section-2-4
https://www.rfc-editor.org/rfc/rfc9449#section-2-5
https://www.rfc-editor.org/rfc/rfc9449#section-2-6
Section 11https://www.rfc-editor.org/rfc/rfc9449#Security
https://www.rfc-editor.org/rfc/rfc9449#section-2-7
3. https://www.rfc-editor.org/rfc/rfc9449#section-3
Concepthttps://www.rfc-editor.org/rfc/rfc9449#name-concept
https://www.rfc-editor.org/rfc/rfc9449#section-3-1
https://www.rfc-editor.org/rfc/rfc9449#section-3-2
https://www.rfc-editor.org/rfc/rfc9449#section-3-3.1
https://www.rfc-editor.org/rfc/rfc9449#section-3-3.2
https://www.rfc-editor.org/rfc/rfc9449#section-3-3.3
https://www.rfc-editor.org/rfc/rfc9449#section-3-3.4
https://www.rfc-editor.org/rfc/rfc9449#section-3-3.5
Figure 1https://www.rfc-editor.org/rfc/rfc9449#figure-1
Basic DPoP Flowhttps://www.rfc-editor.org/rfc/rfc9449#name-basic-dpop-flow
Figure 1https://www.rfc-editor.org/rfc/rfc9449#basic-flow
https://www.rfc-editor.org/rfc/rfc9449#section-3-5
https://www.rfc-editor.org/rfc/rfc9449#section-3-6.1
https://www.rfc-editor.org/rfc/rfc9449#section-3-6.2
https://www.rfc-editor.org/rfc/rfc9449#section-3-6.3
https://www.rfc-editor.org/rfc/rfc9449#section-3-6.4
https://www.rfc-editor.org/rfc/rfc9449#section-3-7
Section 11https://www.rfc-editor.org/rfc/rfc9449#Security
https://www.rfc-editor.org/rfc/rfc9449#section-3-8
4. https://www.rfc-editor.org/rfc/rfc9449#section-4
DPoP Proof JWTshttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-proof-jwts
https://www.rfc-editor.org/rfc/rfc9449#section-4-1
Section 5https://www.rfc-editor.org/rfc/rfc9449#access-token-request
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
https://www.rfc-editor.org/rfc/rfc9449#section-4-2
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
https://www.rfc-editor.org/rfc/rfc9449#section-4-3
4.1. https://www.rfc-editor.org/rfc/rfc9449#section-4.1
The DPoP HTTP Headerhttps://www.rfc-editor.org/rfc/rfc9449#name-the-dpop-http-header
https://www.rfc-editor.org/rfc/rfc9449#section-4.1-1
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-4.1-2.2
Figure 2https://www.rfc-editor.org/rfc/rfc9449#dpop-proof-jwt
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-4.1-3
Figure 2https://www.rfc-editor.org/rfc/rfc9449#figure-2
Example DPoP Headerhttps://www.rfc-editor.org/rfc/rfc9449#name-example-dpop-header
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-4.1-5
Section 11.2https://rfc-editor.org/rfc/rfc9110#section-11.2
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Figure 3https://www.rfc-editor.org/rfc/rfc9449#dpop-header-abnf
https://www.rfc-editor.org/rfc/rfc9449#section-4.1-6
Figure 3https://www.rfc-editor.org/rfc/rfc9449#figure-3
DPoP Header Field ABNFhttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-header-field-abnf
4.2. https://www.rfc-editor.org/rfc/rfc9449#section-4.2
DPoP Proof JWT Syntaxhttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-proof-jwt-syntax
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-1
Section 3.11https://rfc-editor.org/rfc/rfc8725#section-3.11
RFC8725https://www.rfc-editor.org/rfc/rfc9449#RFC8725
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-2.2
IANA.JOSE.ALGShttps://www.rfc-editor.org/rfc/rfc9449#IANA.JOSE.ALGS
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-2.4
RFC7517https://www.rfc-editor.org/rfc/rfc9449#RFC7517
Section 4.1.3https://rfc-editor.org/rfc/rfc7515#section-4.1.3
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-2.6
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-3
RFC4122https://www.rfc-editor.org/rfc/rfc9449#RFC4122
Section 11.1https://www.rfc-editor.org/rfc/rfc9449#Token_Replay
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-4.2
Section 9.1https://rfc-editor.org/rfc/rfc9110#section-9.1
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-4.4
Section 7.1https://rfc-editor.org/rfc/rfc9110#section-7.1
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-4.6
Section 4.1.6https://rfc-editor.org/rfc/rfc7519#section-4.1.6
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-4.8
Section 7https://www.rfc-editor.org/rfc/rfc9449#protected-resource-access
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-5
Section 2https://rfc-editor.org/rfc/rfc7515#section-2
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
SHShttps://www.rfc-editor.org/rfc/rfc9449#SHS
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-6.2
8https://www.rfc-editor.org/rfc/rfc9449#ASNonce
9https://www.rfc-editor.org/rfc/rfc9449#RSNonce
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-7
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-8.2
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-9
Figure 4https://www.rfc-editor.org/rfc/rfc9449#dpop-proof
Figure 2https://www.rfc-editor.org/rfc/rfc9449#dpop-proof-jwt
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-10
Figure 4https://www.rfc-editor.org/rfc/rfc9449#figure-4
Example JWT Content of a DPoP Proofhttps://www.rfc-editor.org/rfc/rfc9449#name-example-jwt-content-of-a-dp
Section 11.7https://www.rfc-editor.org/rfc/rfc9449#request_integrity
https://www.rfc-editor.org/rfc/rfc9449#section-4.2-12
4.3. https://www.rfc-editor.org/rfc/rfc9449#section-4.3
Checking DPoP Proofshttps://www.rfc-editor.org/rfc/rfc9449#name-checking-dpop-proofs
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-1
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.1
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.2
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.3
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.4
IANA.JOSE.ALGShttps://www.rfc-editor.org/rfc/rfc9449#IANA.JOSE.ALGS
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.5
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.6
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.7
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.8
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.9
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.10
Section 11.1https://www.rfc-editor.org/rfc/rfc9449#Token_Replay
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.11
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.12.1
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.12.2.1
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-2.12.2.2
Section 6.2.2https://rfc-editor.org/rfc/rfc3986#section-6.2.2
RFC3986https://www.rfc-editor.org/rfc/rfc9449#RFC3986
Section 6.2.3https://rfc-editor.org/rfc/rfc3986#section-6.2.3
RFC3986https://www.rfc-editor.org/rfc/rfc9449#RFC3986
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-3
https://www.rfc-editor.org/rfc/rfc9449#section-4.3-4
5. https://www.rfc-editor.org/rfc/rfc9449#section-5
DPoP Access Token Requesthttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-access-token-request
RFC7523https://www.rfc-editor.org/rfc/rfc9449#RFC7523
Figure 5https://www.rfc-editor.org/rfc/rfc9449#token-request-code
Figure 5https://www.rfc-editor.org/rfc/rfc9449#token-request-code
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-5-1
Figure 5https://www.rfc-editor.org/rfc/rfc9449#figure-5
Token Request for a DPoP Sender-Constrained Token Using an Authorization Codehttps://www.rfc-editor.org/rfc/rfc9449#name-token-request-for-a-dpop-se
Section 5.2https://rfc-editor.org/rfc/rfc6749#section-5.2
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-5-3
Section 6https://www.rfc-editor.org/rfc/rfc9449#Confirmation
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
Figure 6https://www.rfc-editor.org/rfc/rfc9449#token-response
https://www.rfc-editor.org/rfc/rfc9449#section-5-4
Figure 6https://www.rfc-editor.org/rfc/rfc9449#figure-6
Access Token Responsehttps://www.rfc-editor.org/rfc/rfc9449#name-access-token-response
Figure 6https://www.rfc-editor.org/rfc/rfc9449#token-response
Figure 7https://www.rfc-editor.org/rfc/rfc9449#token-request-rt
Figure 7https://www.rfc-editor.org/rfc/rfc9449#token-request-rt
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-5-6
Figure 7https://www.rfc-editor.org/rfc/rfc9449#figure-7
Token Request for a DPoP-Bound Token Using a Refresh Tokenhttps://www.rfc-editor.org/rfc/rfc9449#name-token-request-for-a-dpop-bo
https://www.rfc-editor.org/rfc/rfc9449#section-5-8
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
https://www.rfc-editor.org/rfc/rfc9449#section-5-9
https://www.rfc-editor.org/rfc/rfc9449#section-5-10
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-5-11
5.1. https://www.rfc-editor.org/rfc/rfc9449#section-5.1
Authorization Server Metadatahttps://www.rfc-editor.org/rfc/rfc9449#name-authorization-server-metada
RFC8414https://www.rfc-editor.org/rfc/rfc9449#RFC8414
https://www.rfc-editor.org/rfc/rfc9449#section-5.1-1
IANA.JOSE.ALGShttps://www.rfc-editor.org/rfc/rfc9449#IANA.JOSE.ALGS
https://www.rfc-editor.org/rfc/rfc9449#section-5.1-2.2
5.2. https://www.rfc-editor.org/rfc/rfc9449#section-5.2
Client Registration Metadatahttps://www.rfc-editor.org/rfc/rfc9449#name-client-registration-metadat
RFC7591https://www.rfc-editor.org/rfc/rfc9449#RFC7591
RFC7591https://www.rfc-editor.org/rfc/rfc9449#RFC7591
https://www.rfc-editor.org/rfc/rfc9449#section-5.2-1
RFC7591https://www.rfc-editor.org/rfc/rfc9449#RFC7591
https://www.rfc-editor.org/rfc/rfc9449#section-5.2-2
https://www.rfc-editor.org/rfc/rfc9449#section-5.2-3.2
https://www.rfc-editor.org/rfc/rfc9449#section-5.2-4
6. https://www.rfc-editor.org/rfc/rfc9449#section-6
Public Key Confirmationhttps://www.rfc-editor.org/rfc/rfc9449#name-public-key-confirmation
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
Section 6.1https://www.rfc-editor.org/rfc/rfc9449#jwk-thumb-jwt
Section 6.2https://www.rfc-editor.org/rfc/rfc9449#jwk-thumb-intro
https://www.rfc-editor.org/rfc/rfc9449#section-6-1
https://www.rfc-editor.org/rfc/rfc9449#section-6-2
6.1. https://www.rfc-editor.org/rfc/rfc9449#section-6.1
JWK Thumbprint Confirmation Methodhttps://www.rfc-editor.org/rfc/rfc9449#name-jwk-thumbprint-confirmation
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
RFC7800https://www.rfc-editor.org/rfc/rfc9449#RFC7800
https://www.rfc-editor.org/rfc/rfc9449#section-6.1-1
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
RFC7638https://www.rfc-editor.org/rfc/rfc9449#RFC7638
https://www.rfc-editor.org/rfc/rfc9449#section-6.1-2.2
Figure 8https://www.rfc-editor.org/rfc/rfc9449#cnf-claim-jwt
Figure 9https://www.rfc-editor.org/rfc/rfc9449#cnf-claim
Section 5https://www.rfc-editor.org/rfc/rfc9449#access-token-request
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-6.1-3
Figure 8https://www.rfc-editor.org/rfc/rfc9449#figure-8
JWT Containing a JWK SHA-256 Thumbprint Confirmationhttps://www.rfc-editor.org/rfc/rfc9449#name-jwt-containing-a-jwk-sha-25
Figure 9https://www.rfc-editor.org/rfc/rfc9449#figure-9
JWT Claims Set with a JWK SHA-256 Thumbprint Confirmationhttps://www.rfc-editor.org/rfc/rfc9449#name-jwt-claims-set-with-a-jwk-s
6.2. https://www.rfc-editor.org/rfc/rfc9449#section-6.2
JWK Thumbprint Confirmation Method in Token Introspectionhttps://www.rfc-editor.org/rfc/rfc9449#name-jwk-thumbprint-confirmation-
RFC7662https://www.rfc-editor.org/rfc/rfc9449#RFC7662
https://www.rfc-editor.org/rfc/rfc9449#section-6.2-1
Section 6.1https://www.rfc-editor.org/rfc/rfc9449#jwk-thumb-jwt
https://www.rfc-editor.org/rfc/rfc9449#section-6.2-2
https://www.rfc-editor.org/rfc/rfc9449#section-6.2-3
Figure 10https://www.rfc-editor.org/rfc/rfc9449#introspect-req
Figure 11https://www.rfc-editor.org/rfc/rfc9449#introspect-resp
Figure 6https://www.rfc-editor.org/rfc/rfc9449#token-response
https://www.rfc-editor.org/rfc/rfc9449#section-6.2-4
Figure 10https://www.rfc-editor.org/rfc/rfc9449#figure-10
Example Introspection Requesthttps://www.rfc-editor.org/rfc/rfc9449#name-example-introspection-reque
Figure 11https://www.rfc-editor.org/rfc/rfc9449#figure-11
Example Introspection Response for a DPoP-Bound Access Tokenhttps://www.rfc-editor.org/rfc/rfc9449#name-example-introspection-respo
7. https://www.rfc-editor.org/rfc/rfc9449#section-7
Protected Resource Accesshttps://www.rfc-editor.org/rfc/rfc9449#name-protected-resource-access
Section 4https://www.rfc-editor.org/rfc/rfc9449#the-proof
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
https://www.rfc-editor.org/rfc/rfc9449#section-7-1
https://www.rfc-editor.org/rfc/rfc9449#section-7-2
Section 4.3https://www.rfc-editor.org/rfc/rfc9449#checking
https://www.rfc-editor.org/rfc/rfc9449#section-7-3
https://www.rfc-editor.org/rfc/rfc9449#section-7-4
7.1. https://www.rfc-editor.org/rfc/rfc9449#section-7.1
The DPoP Authentication Schemehttps://www.rfc-editor.org/rfc/rfc9449#name-the-dpop-authentication-sch
Section 11.6.2https://rfc-editor.org/rfc/rfc9110#section-11.6.2
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Section 11.2https://rfc-editor.org/rfc/rfc9110#section-11.2
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-1
Figure 12https://www.rfc-editor.org/rfc/rfc9449#figure-12
DPoP Authentication Scheme ABNFhttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-authentication-scheme-
Section 4.3https://www.rfc-editor.org/rfc/rfc9449#checking
Section 6https://www.rfc-editor.org/rfc/rfc9449#Confirmation
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-3
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-4
Figure 13https://www.rfc-editor.org/rfc/rfc9449#protected-resource-request
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
Figure 14https://www.rfc-editor.org/rfc/rfc9449#dpop-proof-pr
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-5
Figure 13https://www.rfc-editor.org/rfc/rfc9449#figure-13
DPoP-Protected Resource Requesthttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-protected-resource-req
Figure 14https://www.rfc-editor.org/rfc/rfc9449#figure-14
Decoded Content of the DPoP Proof JWT in Figure 13https://www.rfc-editor.org/rfc/rfc9449#name-decoded-content-of-the-dpop
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Section 15.5.2https://rfc-editor.org/rfc/rfc9110#section-15.5.2
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Section 11.6.1https://rfc-editor.org/rfc/rfc9110#section-11.6.1
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-8
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-9
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.1
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Section 11.5https://rfc-editor.org/rfc/rfc9110#section-11.5
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.2
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
Section 3https://rfc-editor.org/rfc/rfc6750#section-3
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.3
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
Section 3https://rfc-editor.org/rfc/rfc6750#section-3
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
Section 3.1https://rfc-editor.org/rfc/rfc6750#section-3.1
Section 9https://www.rfc-editor.org/rfc/rfc9449#RSNonce
Section 4.3https://www.rfc-editor.org/rfc/rfc9449#checking
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.4
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
Section 3https://rfc-editor.org/rfc/rfc6750#section-3
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.5
RFC7515https://www.rfc-editor.org/rfc/rfc9449#RFC7515
Section 4.1.1https://rfc-editor.org/rfc/rfc7515#section-4.1.1
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.6
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-10.7
Figure 15https://www.rfc-editor.org/rfc/rfc9449#http-401-response-protected-req-without-auth
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-11
Figure 15https://www.rfc-editor.org/rfc/rfc9449#figure-15
HTTP 401 Response to a Protected Resource Request without Authenticationhttps://www.rfc-editor.org/rfc/rfc9449#name-http-401-response-to-a-prot
Figure 16https://www.rfc-editor.org/rfc/rfc9449#http-401-response-protected-req-with-invalid-token
Figure 16https://www.rfc-editor.org/rfc/rfc9449#http-401-response-protected-req-with-invalid-token
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-13
Figure 16https://www.rfc-editor.org/rfc/rfc9449#figure-16
HTTP 401 Response to a Protected Resource Request with an Invalid Tokenhttps://www.rfc-editor.org/rfc/rfc9449#name-http-401-response-to-a-prote
WHATWG.Fetchhttps://www.rfc-editor.org/rfc/rfc9449#WHATWG.Fetch
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-15
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-16
Section 2.1https://rfc-editor.org/rfc/rfc6750#section-2.1
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-7.1-17
7.2. https://www.rfc-editor.org/rfc/rfc9449#section-7.2
Compatibility with the Bearer Authentication Schemehttps://www.rfc-editor.org/rfc/rfc9449#name-compatibility-with-the-bear
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-1
Section 11.6.1https://rfc-editor.org/rfc/rfc9110#section-11.6.1
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-2
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
RFC7662https://www.rfc-editor.org/rfc/rfc9449#RFC7662
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-3
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-4
Section 3.1https://rfc-editor.org/rfc/rfc6750#section-3.1
RFC6750https://www.rfc-editor.org/rfc/rfc9449#RFC6750
Figure 17https://www.rfc-editor.org/rfc/rfc9449#multi-challenge-no-token
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-5.1.1
Figure 18https://www.rfc-editor.org/rfc/rfc9449#multi-challenge-invalid-token
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-5.2.1
Figure 19https://www.rfc-editor.org/rfc/rfc9449#multi-challenge-ambiguous
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-5.3.1
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-7.2-6
Figure 17https://www.rfc-editor.org/rfc/rfc9449#figure-17
HTTP 401 Response to a Protected Resource Request without Authenticationhttps://www.rfc-editor.org/rfc/rfc9449#name-http-401-response-to-a-protec
Figure 18https://www.rfc-editor.org/rfc/rfc9449#figure-18
HTTP 401 Response to a Protected Resource Request with Invalid Authenticationhttps://www.rfc-editor.org/rfc/rfc9449#name-http-401-response-to-a-protect
Figure 19https://www.rfc-editor.org/rfc/rfc9449#figure-19
HTTP 400 Response to a Protected Resource Request with Ambiguous Authenticationhttps://www.rfc-editor.org/rfc/rfc9449#name-http-400-response-to-a-prot
7.3. https://www.rfc-editor.org/rfc/rfc9449#section-7.3
Client Considerationshttps://www.rfc-editor.org/rfc/rfc9449#name-client-considerations
https://www.rfc-editor.org/rfc/rfc9449#section-7.3-1
https://www.rfc-editor.org/rfc/rfc9449#section-7.3-2
8. https://www.rfc-editor.org/rfc/rfc9449#section-8
Authorization Server-Provided Noncehttps://www.rfc-editor.org/rfc/rfc9449#name-authorization-server-provid
https://www.rfc-editor.org/rfc/rfc9449#section-8-1
https://www.rfc-editor.org/rfc/rfc9449#section-8-2
Section 5.2https://rfc-editor.org/rfc/rfc6749#section-5.2
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-8-3
https://www.rfc-editor.org/rfc/rfc9449#section-8-4
Figure 20https://www.rfc-editor.org/rfc/rfc9449#figure-20
HTTP 400 Response to a Token Request without a Noncehttps://www.rfc-editor.org/rfc/rfc9449#name-http-400-response-to-a-toke
https://www.rfc-editor.org/rfc/rfc9449#section-8-6
https://www.rfc-editor.org/rfc/rfc9449#section-8-7
Figure 21https://www.rfc-editor.org/rfc/rfc9449#figure-21
DPoP Proof Payload including a Nonce Valuehttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-proof-payload-includin
https://www.rfc-editor.org/rfc/rfc9449#section-8-9
https://www.rfc-editor.org/rfc/rfc9449#section-8-10
https://www.rfc-editor.org/rfc/rfc9449#section-8-11
WHATWG.Fetchhttps://www.rfc-editor.org/rfc/rfc9449#WHATWG.Fetch
https://www.rfc-editor.org/rfc/rfc9449#section-8-12
8.1. https://www.rfc-editor.org/rfc/rfc9449#section-8.1
Nonce Syntaxhttps://www.rfc-editor.org/rfc/rfc9449#name-nonce-syntax
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-8.1-1
Figure 22https://www.rfc-editor.org/rfc/rfc9449#figure-22
Nonce ABNFhttps://www.rfc-editor.org/rfc/rfc9449#name-nonce-abnf
8.2. https://www.rfc-editor.org/rfc/rfc9449#section-8.2
Providing a New Nonce Valuehttps://www.rfc-editor.org/rfc/rfc9449#name-providing-a-new-nonce-value
https://www.rfc-editor.org/rfc/rfc9449#section-8.2-1
Section 8.1https://www.rfc-editor.org/rfc/rfc9449#NonceSyntax
https://www.rfc-editor.org/rfc/rfc9449#section-8.2-2
https://www.rfc-editor.org/rfc/rfc9449#section-8.2-3
https://www.rfc-editor.org/rfc/rfc9449#section-8.2-4
https://www.rfc-editor.org/rfc/rfc9449#section-8.2-5
Figure 23https://www.rfc-editor.org/rfc/rfc9449#figure-23
HTTP 200 Response Providing the Next Nonce Valuehttps://www.rfc-editor.org/rfc/rfc9449#name-http-200-response-providing
9. https://www.rfc-editor.org/rfc/rfc9449#section-9
Resource Server-Provided Noncehttps://www.rfc-editor.org/rfc/rfc9449#name-resource-server-provided-no
8https://www.rfc-editor.org/rfc/rfc9449#ASNonce
8.2https://www.rfc-editor.org/rfc/rfc9449#NewNonce
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
https://www.rfc-editor.org/rfc/rfc9449#section-9-1
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-9-2
Figure 24https://www.rfc-editor.org/rfc/rfc9449#figure-24
HTTP 401 Response to a Resource Request without a Noncehttps://www.rfc-editor.org/rfc/rfc9449#name-http-401-response-to-a-reso
OpenID.Corehttps://www.rfc-editor.org/rfc/rfc9449#OpenID.Core
https://www.rfc-editor.org/rfc/rfc9449#section-9-4
10. https://www.rfc-editor.org/rfc/rfc9449#section-10
Authorization Code Binding to a DPoP Keyhttps://www.rfc-editor.org/rfc/rfc9449#name-authorization-code-binding-
RFC7638https://www.rfc-editor.org/rfc/rfc9449#RFC7638
Section 6.1https://www.rfc-editor.org/rfc/rfc9449#jwk-thumb-jwt
https://www.rfc-editor.org/rfc/rfc9449#section-10-1
https://www.rfc-editor.org/rfc/rfc9449#section-10-2
RFC8792https://www.rfc-editor.org/rfc/rfc9449#RFC8792
https://www.rfc-editor.org/rfc/rfc9449#section-10-3
Figure 25https://www.rfc-editor.org/rfc/rfc9449#figure-25
Authorization Request Using the dpop_jkt Parameterhttps://www.rfc-editor.org/rfc/rfc9449#name-authorization-request-using
RFC7636https://www.rfc-editor.org/rfc/rfc9449#RFC7636
SECURITY-TOPICShttps://www.rfc-editor.org/rfc/rfc9449#I-D.ietf-oauth-security-topics
https://www.rfc-editor.org/rfc/rfc9449#section-10-5
10.1. https://www.rfc-editor.org/rfc/rfc9449#section-10.1
DPoP with Pushed Authorization Requestshttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-with-pushed-authorizat
RFC9126https://www.rfc-editor.org/rfc/rfc9449#RFC9126
https://www.rfc-editor.org/rfc/rfc9449#section-10.1-1
Section 10https://www.rfc-editor.org/rfc/rfc9449#dpop_jkt
https://www.rfc-editor.org/rfc/rfc9449#section-10.1-2.1
Section 4.3https://www.rfc-editor.org/rfc/rfc9449#checking
https://www.rfc-editor.org/rfc/rfc9449#section-10.1-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-10.1-3
https://www.rfc-editor.org/rfc/rfc9449#section-10.1-4
11. https://www.rfc-editor.org/rfc/rfc9449#section-11
Security Considerationshttps://www.rfc-editor.org/rfc/rfc9449#name-security-considerations
Section 2https://www.rfc-editor.org/rfc/rfc9449#objective
RFC6125https://www.rfc-editor.org/rfc/rfc9449#RFC6125
RFC8705https://www.rfc-editor.org/rfc/rfc9449#RFC8705
TOKEN-BINDINGhttps://www.rfc-editor.org/rfc/rfc9449#I-D.ietf-oauth-token-binding
11.1https://www.rfc-editor.org/rfc/rfc9449#Token_Replay
11.7https://www.rfc-editor.org/rfc/rfc9449#request_integrity
https://www.rfc-editor.org/rfc/rfc9449#section-11-1
11.1. https://www.rfc-editor.org/rfc/rfc9449#section-11.1
DPoP Proof Replayhttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-proof-replay
https://www.rfc-editor.org/rfc/rfc9449#section-11.1-1
https://www.rfc-editor.org/rfc/rfc9449#section-11.1-2
https://www.rfc-editor.org/rfc/rfc9449#section-11.1-3
https://www.rfc-editor.org/rfc/rfc9449#section-11.1-4
https://www.rfc-editor.org/rfc/rfc9449#section-11.1-5
11.2. https://www.rfc-editor.org/rfc/rfc9449#section-11.2
DPoP Proof Pre-generationhttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-proof-pre-generation
https://www.rfc-editor.org/rfc/rfc9449#section-11.2-1
https://www.rfc-editor.org/rfc/rfc9449#section-11.2-2
https://www.rfc-editor.org/rfc/rfc9449#section-11.2-3
11.3. https://www.rfc-editor.org/rfc/rfc9449#section-11.3
DPoP Nonce Downgradehttps://www.rfc-editor.org/rfc/rfc9449#name-dpop-nonce-downgrade
https://www.rfc-editor.org/rfc/rfc9449#section-11.3-1
11.4. https://www.rfc-editor.org/rfc/rfc9449#section-11.4
Untrusted Code in the Client Contexthttps://www.rfc-editor.org/rfc/rfc9449#name-untrusted-code-in-the-clien
https://www.rfc-editor.org/rfc/rfc9449#section-11.4-1
https://www.rfc-editor.org/rfc/rfc9449#section-11.4-2
https://www.rfc-editor.org/rfc/rfc9449#section-11.4-3
https://www.rfc-editor.org/rfc/rfc9449#section-11.4-4
W3C.CSPhttps://www.rfc-editor.org/rfc/rfc9449#W3C.CSP
https://www.rfc-editor.org/rfc/rfc9449#section-11.4-5
11.5. https://www.rfc-editor.org/rfc/rfc9449#section-11.5
Signed JWT Swappinghttps://www.rfc-editor.org/rfc/rfc9449#name-signed-jwt-swapping
https://www.rfc-editor.org/rfc/rfc9449#section-11.5-1
11.6. https://www.rfc-editor.org/rfc/rfc9449#section-11.6
Signature Algorithmshttps://www.rfc-editor.org/rfc/rfc9449#name-signature-algorithms
https://www.rfc-editor.org/rfc/rfc9449#section-11.6-1
11.7. https://www.rfc-editor.org/rfc/rfc9449#section-11.7
Request Integrityhttps://www.rfc-editor.org/rfc/rfc9449#name-request-integrity
https://www.rfc-editor.org/rfc/rfc9449#section-11.7-1
https://www.rfc-editor.org/rfc/rfc9449#section-11.7-2
https://www.rfc-editor.org/rfc/rfc9449#section-11.7-3
11.8. https://www.rfc-editor.org/rfc/rfc9449#section-11.8
Access Token and Public Key Bindinghttps://www.rfc-editor.org/rfc/rfc9449#name-access-token-and-public-key
Section 6https://www.rfc-editor.org/rfc/rfc9449#Confirmation
https://www.rfc-editor.org/rfc/rfc9449#section-11.8-1
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-11.8-2
11.9. https://www.rfc-editor.org/rfc/rfc9449#section-11.9
Authorization Code and Public Key Bindinghttps://www.rfc-editor.org/rfc/rfc9449#name-authorization-code-and-publ
Section 10https://www.rfc-editor.org/rfc/rfc9449#dpop_jkt
https://www.rfc-editor.org/rfc/rfc9449#section-11.9-1
https://www.rfc-editor.org/rfc/rfc9449#section-11.9-2
https://www.rfc-editor.org/rfc/rfc9449#section-11.9-3
https://www.rfc-editor.org/rfc/rfc9449#section-11.9-4
11.10. https://www.rfc-editor.org/rfc/rfc9449#section-11.10
Hash Algorithm Agilityhttps://www.rfc-editor.org/rfc/rfc9449#name-hash-algorithm-agility
https://www.rfc-editor.org/rfc/rfc9449#section-11.10-1
11.11. https://www.rfc-editor.org/rfc/rfc9449#section-11.11
Binding to Client Identityhttps://www.rfc-editor.org/rfc/rfc9449#name-binding-to-client-identity
https://www.rfc-editor.org/rfc/rfc9449#section-11.11-1
12. https://www.rfc-editor.org/rfc/rfc9449#section-12
IANA Considerationshttps://www.rfc-editor.org/rfc/rfc9449#name-iana-considerations
12.1. https://www.rfc-editor.org/rfc/rfc9449#section-12.1
OAuth Access Token Types Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-oauth-access-token-types-re
IANA.OAuth.Paramshttps://www.rfc-editor.org/rfc/rfc9449#IANA.OAuth.Params
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-2.6
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.1-2.10
12.2. https://www.rfc-editor.org/rfc/rfc9449#section-12.2
OAuth Extensions Error Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-oauth-extensions-error-regi
IANA.OAuth.Paramshttps://www.rfc-editor.org/rfc/rfc9449#IANA.OAuth.Params
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-2.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-2.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-2.2.2.6
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-2.2.2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-2.2.2.10
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-3.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-3.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-3.2.2.6
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-3.2.2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.2-3.2.2.10
12.3. https://www.rfc-editor.org/rfc/rfc9449#section-12.3
OAuth Parameters Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-oauth-parameters-registrati
IANA.OAuth.Paramshttps://www.rfc-editor.org/rfc/rfc9449#IANA.OAuth.Params
RFC6749https://www.rfc-editor.org/rfc/rfc9449#RFC6749
https://www.rfc-editor.org/rfc/rfc9449#section-12.3-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.3-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.3-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.3-2.6
Section 10https://www.rfc-editor.org/rfc/rfc9449#dpop_jkt
https://www.rfc-editor.org/rfc/rfc9449#section-12.3-2.8
12.4. https://www.rfc-editor.org/rfc/rfc9449#section-12.4
HTTP Authentication Schemes Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-http-authentication-schemes
IANA.HTTP.AuthSchemeshttps://www.rfc-editor.org/rfc/rfc9449#IANA.HTTP.AuthSchemes
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
Section 16.4.1https://rfc-editor.org/rfc/rfc9110#section-16.4.1
https://www.rfc-editor.org/rfc/rfc9449#section-12.4-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.4-2.2
Section 7.1https://www.rfc-editor.org/rfc/rfc9449#http-auth-scheme
https://www.rfc-editor.org/rfc/rfc9449#section-12.4-2.4
12.5. https://www.rfc-editor.org/rfc/rfc9449#section-12.5
Media Type Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-media-type-registration
RFC2046https://www.rfc-editor.org/rfc/rfc9449#RFC2046
IANA.MediaTypeshttps://www.rfc-editor.org/rfc/rfc9449#IANA.MediaTypes
RFC6838https://www.rfc-editor.org/rfc/rfc9449#RFC6838
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.6
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.10
Section 11https://www.rfc-editor.org/rfc/rfc9449#Security
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.12
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.14
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.16
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.18
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.20
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.22.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.22.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.24
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.26
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.28
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.30
https://www.rfc-editor.org/rfc/rfc9449#section-12.5-2.32
12.6. https://www.rfc-editor.org/rfc/rfc9449#section-12.6
JWT Confirmation Methods Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-jwt-confirmation-methods-re
IANA.JWThttps://www.rfc-editor.org/rfc/rfc9449#IANA.JWT
RFC7800https://www.rfc-editor.org/rfc/rfc9449#RFC7800
https://www.rfc-editor.org/rfc/rfc9449#section-12.6-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.6-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.6-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.6-2.6
Section 6https://www.rfc-editor.org/rfc/rfc9449#Confirmation
https://www.rfc-editor.org/rfc/rfc9449#section-12.6-2.8
12.7. https://www.rfc-editor.org/rfc/rfc9449#section-12.7
JSON Web Token Claims Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-json-web-token-claims-regis
IANA.JWThttps://www.rfc-editor.org/rfc/rfc9449#IANA.JWT
RFC7519https://www.rfc-editor.org/rfc/rfc9449#RFC7519
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-2.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-2.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-2.2.2.6
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-2.2.2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-3.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-3.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-3.2.2.6
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-3.2.2.8
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-4.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-4.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-4.2.2.6
Section 4.2https://www.rfc-editor.org/rfc/rfc9449#DPoP-Proof-Syntax
https://www.rfc-editor.org/rfc/rfc9449#section-12.7-4.2.2.8
12.7.1. https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1
"nonce" Registration Updatehttps://www.rfc-editor.org/rfc/rfc9449#name-nonce-registration-update
RFC4949https://www.rfc-editor.org/rfc/rfc9449#RFC4949
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-1
OpenID.Corehttps://www.rfc-editor.org/rfc/rfc9449#OpenID.Core
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-2
IANA.JWThttps://www.rfc-editor.org/rfc/rfc9449#IANA.JWT
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-3
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-4.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-4.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-4.6
Section 2https://openid.net/specs/openid-connect-core-1_0.html#IDToken
OpenID.Corehttps://www.rfc-editor.org/rfc/rfc9449#OpenID.Core
https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1-4.8
12.8. https://www.rfc-editor.org/rfc/rfc9449#section-12.8
Hypertext Transfer Protocol (HTTP) Field Name Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-hypertext-transfer-protocol
IANA.HTTP.Fieldshttps://www.rfc-editor.org/rfc/rfc9449#IANA.HTTP.Fields
RFC9110https://www.rfc-editor.org/rfc/rfc9449#RFC9110
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-2.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-2.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-2.2.2.6
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-3.2.2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-3.2.2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.8-3.2.2.6
12.9. https://www.rfc-editor.org/rfc/rfc9449#section-12.9
OAuth Authorization Server Metadata Registrationhttps://www.rfc-editor.org/rfc/rfc9449#name-oauth-authorization-server-
IANA.OAuth.Paramshttps://www.rfc-editor.org/rfc/rfc9449#IANA.OAuth.Params
RFC8414https://www.rfc-editor.org/rfc/rfc9449#RFC8414
https://www.rfc-editor.org/rfc/rfc9449#section-12.9-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.9-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.9-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.9-2.6
Section 5.1https://www.rfc-editor.org/rfc/rfc9449#as-meta
https://www.rfc-editor.org/rfc/rfc9449#section-12.9-2.8
12.10. https://www.rfc-editor.org/rfc/rfc9449#section-12.10
OAuth Dynamic Client Registration Metadatahttps://www.rfc-editor.org/rfc/rfc9449#name-oauth-dynamic-client-regist
IANA.OAuth.Paramshttps://www.rfc-editor.org/rfc/rfc9449#IANA.OAuth.Params
RFC7591https://www.rfc-editor.org/rfc/rfc9449#RFC7591
https://www.rfc-editor.org/rfc/rfc9449#section-12.10-1
https://www.rfc-editor.org/rfc/rfc9449#section-12.10-2.2
https://www.rfc-editor.org/rfc/rfc9449#section-12.10-2.4
https://www.rfc-editor.org/rfc/rfc9449#section-12.10-2.6
Section 5.2https://www.rfc-editor.org/rfc/rfc9449#client-meta
https://www.rfc-editor.org/rfc/rfc9449#section-12.10-2.8
13. https://www.rfc-editor.org/rfc/rfc9449#section-13
Referenceshttps://www.rfc-editor.org/rfc/rfc9449#name-references
13.1. https://www.rfc-editor.org/rfc/rfc9449#section-13.1
Normative Referenceshttps://www.rfc-editor.org/rfc/rfc9449#name-normative-references
https://www.rfc-editor.org/info/rfc2119https://www.rfc-editor.org/info/rfc2119
https://www.rfc-editor.org/info/rfc3986https://www.rfc-editor.org/info/rfc3986
https://www.rfc-editor.org/info/rfc5234https://www.rfc-editor.org/info/rfc5234
https://www.rfc-editor.org/info/rfc6125https://www.rfc-editor.org/info/rfc6125
https://www.rfc-editor.org/info/rfc6749https://www.rfc-editor.org/info/rfc6749
https://www.rfc-editor.org/info/rfc6750https://www.rfc-editor.org/info/rfc6750
https://www.rfc-editor.org/info/rfc7515https://www.rfc-editor.org/info/rfc7515
https://www.rfc-editor.org/info/rfc7517https://www.rfc-editor.org/info/rfc7517
https://www.rfc-editor.org/info/rfc7519https://www.rfc-editor.org/info/rfc7519
https://www.rfc-editor.org/info/rfc7638https://www.rfc-editor.org/info/rfc7638
https://www.rfc-editor.org/info/rfc7800https://www.rfc-editor.org/info/rfc7800
https://www.rfc-editor.org/info/rfc8174https://www.rfc-editor.org/info/rfc8174
http://dx.doi.org/10.6028/NIST.FIPS.180-4https://dx.doi.org/10.6028/NIST.FIPS.180-4
13.2. https://www.rfc-editor.org/rfc/rfc9449#section-13.2
Informative Referenceshttps://www.rfc-editor.org/rfc/rfc9449#name-informative-references
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4929https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4929
https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0160https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0160
https://www.iana.org/assignments/http-authschemes/https://www.iana.org/assignments/http-authschemes/
https://www.iana.org/assignments/http-fields/https://www.iana.org/assignments/http-fields/
https://www.iana.org/assignments/jose/https://www.iana.org/assignments/jose/
https://www.iana.org/assignments/jwt/https://www.iana.org/assignments/jwt/
https://www.iana.org/assignments/media-types/https://www.iana.org/assignments/media-types/
https://www.iana.org/assignments/oauth-parameters/https://www.iana.org/assignments/oauth-parameters/
https://openid.net/specs/openid-connect-core-1_0.htmlhttps://openid.net/specs/openid-connect-core-1_0.html
https://www.rfc-editor.org/info/rfc2046https://www.rfc-editor.org/info/rfc2046
https://www.rfc-editor.org/info/rfc4122https://www.rfc-editor.org/info/rfc4122
https://www.rfc-editor.org/info/rfc4949https://www.rfc-editor.org/info/rfc4949
https://www.rfc-editor.org/info/rfc6838https://www.rfc-editor.org/info/rfc6838
https://www.rfc-editor.org/info/rfc7523https://www.rfc-editor.org/info/rfc7523
https://www.rfc-editor.org/info/rfc7591https://www.rfc-editor.org/info/rfc7591
https://www.rfc-editor.org/info/rfc7636https://www.rfc-editor.org/info/rfc7636
https://www.rfc-editor.org/info/rfc7662https://www.rfc-editor.org/info/rfc7662
https://www.rfc-editor.org/info/rfc8414https://www.rfc-editor.org/info/rfc8414
https://www.rfc-editor.org/info/rfc8705https://www.rfc-editor.org/info/rfc8705
https://www.rfc-editor.org/info/rfc8707https://www.rfc-editor.org/info/rfc8707
https://www.rfc-editor.org/info/rfc8725https://www.rfc-editor.org/info/rfc8725
https://www.rfc-editor.org/info/rfc8792https://www.rfc-editor.org/info/rfc8792
https://www.rfc-editor.org/info/rfc9110https://www.rfc-editor.org/info/rfc9110
https://www.rfc-editor.org/info/rfc9126https://www.rfc-editor.org/info/rfc9126
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-23https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-23
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-token-binding-08https://datatracker.ietf.org/doc/html/draft-ietf-oauth-token-binding-08
https://www.w3.org/TR/CSP3/https://www.w3.org/TR/CSP3/
https://www.w3.org/TR/2017/REC-WebCryptoAPI-20170126https://www.w3.org/TR/2017/REC-WebCryptoAPI-20170126
https://fetch.spec.whatwg.org/https://fetch.spec.whatwg.org/
Acknowledgementshttps://www.rfc-editor.org/rfc/rfc9449#name-acknowledgements
https://www.rfc-editor.org/rfc/rfc9449#appendix-A-1
https://www.rfc-editor.org/rfc/rfc9449#appendix-A-2
Authors' Addresseshttps://www.rfc-editor.org/rfc/rfc9449#name-authors-addresses
https://self-issued.info/https://self-issued.info/
1 Introduction https://www.rfc-editor.org/rfc/rfc9449#section-1
1.1 Conventions and Terminology https://www.rfc-editor.org/rfc/rfc9449#section-1.1
2 Objectives https://www.rfc-editor.org/rfc/rfc9449#section-2
3 Concept https://www.rfc-editor.org/rfc/rfc9449#section-3
4 DPoP Proof JWTs https://www.rfc-editor.org/rfc/rfc9449#section-4
4.1 The DPoP HTTP Header https://www.rfc-editor.org/rfc/rfc9449#section-4.1
4.2 DPoP Proof JWT Syntax https://www.rfc-editor.org/rfc/rfc9449#section-4.2
4.3 Checking DPoP Proofs https://www.rfc-editor.org/rfc/rfc9449#section-4.3
5 DPoP Access Token Request https://www.rfc-editor.org/rfc/rfc9449#section-5
5.1 Authorization Server Metadata https://www.rfc-editor.org/rfc/rfc9449#section-5.1
5.2 Client Registration Metadata https://www.rfc-editor.org/rfc/rfc9449#section-5.2
6 Public Key Confirmation https://www.rfc-editor.org/rfc/rfc9449#section-6
6.1 JWK Thumbprint Confirmation Method https://www.rfc-editor.org/rfc/rfc9449#section-6.1
6.2 JWK Thumbprint Confirmation Method in Token Introspection https://www.rfc-editor.org/rfc/rfc9449#section-6.2
7 Protected Resource Access https://www.rfc-editor.org/rfc/rfc9449#section-7
7.1 The DPoP Authentication Scheme https://www.rfc-editor.org/rfc/rfc9449#section-7.1
7.2 Compatibility with the Bearer Authentication Scheme https://www.rfc-editor.org/rfc/rfc9449#section-7.2
7.3 Client Considerations https://www.rfc-editor.org/rfc/rfc9449#section-7.3
8 Authorization Server-Provided Nonce https://www.rfc-editor.org/rfc/rfc9449#section-8
8.1 Nonce Syntax https://www.rfc-editor.org/rfc/rfc9449#section-8.1
8.2 Providing a New Nonce Value https://www.rfc-editor.org/rfc/rfc9449#section-8.2
9 Resource Server-Provided Nonce https://www.rfc-editor.org/rfc/rfc9449#section-9
10 Authorization Code Binding to a DPoP Key https://www.rfc-editor.org/rfc/rfc9449#section-10
10.1 DPoP with Pushed Authorization Requests https://www.rfc-editor.org/rfc/rfc9449#section-10.1
11 Security Considerations https://www.rfc-editor.org/rfc/rfc9449#section-11
11.1 DPoP Proof Replay https://www.rfc-editor.org/rfc/rfc9449#section-11.1
11.2 DPoP Proof Pre-generation https://www.rfc-editor.org/rfc/rfc9449#section-11.2
11.3 DPoP Nonce Downgrade https://www.rfc-editor.org/rfc/rfc9449#section-11.3
11.4 Untrusted Code in the Client Context https://www.rfc-editor.org/rfc/rfc9449#section-11.4
11.5 Signed JWT Swapping https://www.rfc-editor.org/rfc/rfc9449#section-11.5
11.6 Signature Algorithms https://www.rfc-editor.org/rfc/rfc9449#section-11.6
11.7 Request Integrity https://www.rfc-editor.org/rfc/rfc9449#section-11.7
11.8 Access Token and Public Key Binding https://www.rfc-editor.org/rfc/rfc9449#section-11.8
11.9 Authorization Code and Public Key Binding https://www.rfc-editor.org/rfc/rfc9449#section-11.9
11.10 Hash Algorithm Agility https://www.rfc-editor.org/rfc/rfc9449#section-11.10
11.11 Binding to Client Identity https://www.rfc-editor.org/rfc/rfc9449#section-11.11
12 IANA Considerations https://www.rfc-editor.org/rfc/rfc9449#section-12
12.1 OAuth Access Token Types Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.1
12.2 OAuth Extensions Error Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.2
12.3 OAuth Parameters Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.3
12.4 HTTP Authentication Schemes Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.4
12.5 Media Type Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.5
12.6 JWT Confirmation Methods Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.6
12.7 JSON Web Token Claims Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.7
12.7.1 "nonce" Registration Update https://www.rfc-editor.org/rfc/rfc9449#section-12.7.1
12.8 Hypertext Transfer Protocol (HTTP) Field Name Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.8
12.9 OAuth Authorization Server Metadata Registration https://www.rfc-editor.org/rfc/rfc9449#section-12.9
12.10 OAuth Dynamic Client Registration Metadata https://www.rfc-editor.org/rfc/rfc9449#section-12.10
13 References https://www.rfc-editor.org/rfc/rfc9449#section-13
13.1 Normative References https://www.rfc-editor.org/rfc/rfc9449#section-13.1
13.2 Informative References https://www.rfc-editor.org/rfc/rfc9449#section-13.2
Acknowledgements https://www.rfc-editor.org/rfc/rfc9449#name-acknowledgements
Authors' Addresses https://www.rfc-editor.org/rfc/rfc9449#name-authors-addresses
D. Fetthttps://datatracker.ietf.org/person/Daniel%20Fett
B. Campbellhttps://datatracker.ietf.org/person/Brian%20Campbell
J. Bradleyhttps://datatracker.ietf.org/person/John%20Bradley
T. Lodderstedthttps://datatracker.ietf.org/person/Torsten%20Lodderstedt
M. Joneshttps://datatracker.ietf.org/person/Michael%20B.%20Jones
D. Waitehttps://datatracker.ietf.org/person/David%20Waite
Web Authorization Protocol (OAUTH)https://datatracker.ietf.org/wg/oauth/about/
Security Area (SEC)https://datatracker.ietf.org/wg/#SEC
IETFhttps://www.ietf.org
https://doi.org/10.17487/RFC9449https://doi.org/10.17487/RFC9449
TXThttps://www.rfc-editor.org/rfc/rfc9449.txt
HTMLhttps://www.rfc-editor.org/rfc/rfc9449.html
XMLhttps://www.rfc-editor.org/rfc/rfc9449.xml
PDFhttps://www.rfc-editor.org/rfc/rfc9449.pdf
TXThttps://www.rfc-editor.org/refs/ref9449.txt
XMLhttps://bib.ietf.org/public/rfc/bibxml/reference.RFC.9449.xml
BibTeXhttps://datatracker.ietf.org/doc/rfc9449/bibtex/
RFC 9449 Erratahttps://errata.rfc-editor.org/search/?rfc_number=9449
Internet Engineering Task Force https://www.ietf.org
https://www.ietf.org
System Statushttps://status.ietf.org
Report a Bughttps://github.com/ietf-tools/red/issues
IETF.orghttps://www.ietf.org
IRTF.orghttps://www.irtf.org
IAB.orghttps://www.iab.org
Datatrackerhttps://datatracker.ietf.org
Author Resourceshttps://authors.ietf.org
RFC Editorhttps://www.rfc-editor.org/about/contact/
rfc-dist Info Pagehttps://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
rfc-interest Info Pagehttps://mailman.rfc-editor.org/mailman/listinfo/rfc-interest
Expand sidebarhttps://www.rfc-editor.org/rfc/rfc9449#top

Viewport: width=device-width, initial-scale=1


URLs of crawlers that visited me.