RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)

This document describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism…

Read RFC 9449 on the RFC Editor

Outgoing relationships (27 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Normative reference — RFC 5234: Augmented BNF for Syntax Specifications: ABNF
Normative reference — RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
Normative reference — RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
Normative reference — RFC 7519: JSON Web Token (JWT)
Normative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Normative reference — RFC 7515: JSON Web Signature (JWS)
Normative reference — RFC 7517: JSON Web Key (JWK)
Normative reference — RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
Normative reference — RFC 7638: JSON Web Key (JWK) Thumbprint
Normative reference — RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
Informative reference — RFC 2046: Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types
Informative reference — RFC 6838: Media Type Specifications and Registration Procedures
Informative reference — RFC 4949: Internet Security Glossary, Version 2
Informative reference — RFC 9110: HTTP Semantics
Informative reference — RFC 4122: A Universally Unique IDentifier (UUID) URN Namespace
Informative reference — RFC 8792: Handling Long Lines in Content of Internet-Drafts and RFCs
Informative reference — RFC 8414: OAuth 2.0 Authorization Server Metadata
Informative reference — RFC 7662: OAuth 2.0 Token Introspection
Informative reference — RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol
Informative reference — RFC 8725: JSON Web Token Best Current Practices
Informative reference — RFC 7523: JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
Informative reference — RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
Informative reference — RFC 8707: Resource Indicators for OAuth 2.0
Informative reference — RFC 7636: Proof Key for Code Exchange by OAuth Public Clients
Informative reference — RFC 9126: OAuth 2.0 Pushed Authorization Requests

Incoming relationships (2 related RFCs)

Normatively referenced by — RFC 9728: OAuth 2.0 Protected Resource Metadata
Informatively referenced by — RFC 9700: Best Current Practice for OAuth 2.0 Security