Skip to content

Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)#16574

Merged
jgrandja merged 1 commit intospring-projects:mainfrom
jgrandja:dpop-authn
Feb 11, 2025
Merged

Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)#16574
jgrandja merged 1 commit intospring-projects:mainfrom
jgrandja:dpop-authn

Conversation

@jgrandja
Copy link
Copy Markdown
Contributor

@jgrandja jgrandja commented Feb 11, 2025 •
edited
Loading

This PR adds resource server support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP).

See DPoPAuthenticationConfigurerTests which demonstrates how to use DPoP-bound access token authentication.

spring-security/config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurerTests.java

Line 81 in 2480d41

public class DPoPAuthenticationConfigurerTests {

Related spring-authorization-server#1813

@jgrandja jgrandja self-assigned this Feb 11, 2025
@jgrandja jgrandja added the type: enhancement A general enhancement label Feb 11, 2025
@jgrandja jgrandja added this to the 6.5.0-M2 milestone Feb 11, 2025
@jgrandja jgrandja added the in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) label Feb 11, 2025
@jgrandja jgrandja merged commit 2480d41 into spring-projects:main Feb 11, 2025
@jgrandja jgrandja deleted the dpop-authn branch February 11, 2025 19:10
This was referenced Feb 11, 2025
Closed
Closed
@jgrandja jgrandja mentioned this pull request Apr 7, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 7, 2025
@jgrandja
Add AuthenticationEntryPoint for DPoP
9c073db 
Issue gh-16574

Closes gh-16900
@jgrandja jgrandja mentioned this pull request Apr 10, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 10, 2025
@jgrandja
Make DPoP IatClaimValidator public to allow configuring clock and clo…
1ca33ca 
…ckSkew

Issue gh-16574

Closes gh-16921
@jgrandja jgrandja mentioned this pull request Apr 14, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 14, 2025
@jgrandja
Prevent downgraded usage of DPoP-bound access tokens
791feee 
Issue gh-16574

Closes gh-16937
This was referenced May 7, 2025
Closed
Closed
@everflux everflux mentioned this pull request Jun 14, 2025
Open
@jgrandja jgrandja mentioned this pull request Dec 4, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@jgrandja jgrandja

Labels

in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement

Projects

None yet

Milestone

6.5.0-M2

Development

Successfully merging this pull request may close these issues.

1 participant

@jgrandja