feat(sep-1932): Client check for dpop_jkt - #523
Draft
nbarbettini wants to merge 2 commits into
Draft
nbarbettini wants to merge 2 commits into
nbarbettini wants to merge 2 commits into
Conversation
…pop_jkt SEP-1932 adopts RFC 9449 §10, so a client binds its authorization code to its DPoP key and the test authorization server rejects a mismatched thumbprint. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
commit: |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Discussed here: https://discord.com/channels/1358869848138059966/1552316422951149639
Motivation and Context
There is a short window between authorization and token exchange where a stolen authorization code could be redeemed using an attacker-controlled DPoP key. The
dpop_jktauthorization parameter closes that gap by declaring which key may redeem the code.This change adds a client check for
dpop_jktassuming SEP-1932 ends up with a SHOULD fordpop_jkt.The test client sends
dpop_jkt, and the test authorization server stores it with the specific authorization code. During token exchange, the server compares it with the key in the DPoP proof. Omittingdpop_jktproduces a WARNING; sending a mismatched thumbprint produces a FAILURE. Authorization state is tracked per code internally so overlapping flows cannot overwrite each other.How Has This Been Tested?
dpop_jktBreaking Changes
No API or configuration changes.
Clients participating in the DPoP extension may receive a new WARNING if they omit
dpop_jkt, assuming SEP-1932 ends up with a SHOULD.Types of changes
Checklist