A copied permission note should not open the door
01A photo app wants to fetch pictures. Someone copies its permission note. See why a separate, freshly signed request matters.
Assume the owner already granted the required permission. This lesson adds a possession check.
Offline worked example. Signature fixtures and key/token hashes can be checked locally; ordinary OAuth, TLS and deployment policy checks remain separate. This is not a production validator.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
Assume ordinary permission checks pass. The app can make a fresh proof with the token’s matching private key.
Key idea: A key-bound token needs a matching proof, not just possession of the note.
Terms
- DPoP
- A separately signed note proving use of a key for a particular request. It accompanies, rather than replaces, the access token.
- Public key and private key
- The shareable key checks signatures. The matching secret key makes them. A public key is not a registered app identity by itself.
Rules & examples
A key-bound token needs a matching proof, not just possession of the note.
These reference examples may differ from the selected experiment.
- DPoP means Demonstrating Proof of Possession. It is application-level sender constraint, not OAuth client authentication.
- DPoP always requires HTTPS. Grant permission and ordinary token validation remain separate checks.
Bounded offline worked example, not a production OAuth, TLS or general JWT validator. Cryptographic signature fixtures and public-key/token hashes are independently checked.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.