Intermediate LevelAuthentication & Authorization
What is DPoP (Demonstrating Proof-of-Possession / RFC 9449) and how does it prevent token theft?
❓ Interview Prompt: Explain DPoP JWT proof headers, asymmetric client key pairs, preventing stolen bearer token replay, and RFC 9449.
Standard Bearer tokens are vulnerable: if an attacker steals a valid Bearer token via network sniffing or server logs, they can replay it from any computer. DPoP (Demonstrating Proof-of-Possession) (RFC 9449) cryptographically binds tokens to a specific client.
How DPoP Works:
1
Client generates a local ephemeral public/private key pair.
2
For every API request, the client generates a signed DPoP Proof JWT using its private key, attaching it in the 'DPoP: <proof_jwt>' header.
3
The DPoP Proof JWT contains HTTP Method, Request URI, and Nonce.
4
The API Server verifies that the access token is bound to the public key in the DPoP Proof JWT.
5
If an attacker steals the access token, it is completely useless without the client's private key!
Code Implementation Example
typescript
// Client making API request with DPoP proof header
async function fetchWithDpop(url: string, accessToken: string, privateKey: crypto.KeyObject, publicKeyJwk: object) {
// Create ephemeral DPoP proof header JWT
const dpopProof = jwt.sign(
{ htm: 'GET', htu: url, jti: crypto.randomUUID() },
privateKey,
{ algorithm: 'ES256', header: { typ: 'dpop+jwt', jwk: publicKeyJwk } }
);
return await fetch(url, {
headers: {
'Authorization': "DPoP " + accessToken, // DPoP scheme instead of Bearer!
'DPoP': dpopProof
}
});
}💡Constructing DPoP proof JWT header for sender-constrained token authorization.
🎯 Interview Key Takeaway
DPoP cryptographically binds access tokens to client private keys, rendering stolen bearer tokens useless to attackers.
#DPoP#RFC 9449#Proof of Possession#Security#Intermediate
Back to all Authentication & Authorization Questions→