KEMBAR78
Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP) by jgrandja · Pull Request #16574 · spring-projects/spring-security · GitHub
Skip to content

Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP) #16574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 11, 2025
Merged

Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP) #16574

merged 1 commit into from
Feb 11, 2025

Conversation

@jgrandja
Copy link
Contributor

@jgrandja jgrandja commented Feb 11, 2025 •
edited
Loading

This PR adds resource server support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP).

See DPoPAuthenticationConfigurerTests which demonstrates how to use DPoP-bound access token authentication.

spring-security/config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurerTests.java

Line 81 in 2480d41

public class DPoPAuthenticationConfigurerTests {

Related spring-authorization-server#1813

@jgrandja jgrandja self-assigned this Feb 11, 2025
@jgrandja jgrandja added the type: enhancement A general enhancement label Feb 11, 2025
@jgrandja jgrandja added this to the 6.5.0-M2 milestone Feb 11, 2025
@jgrandja
Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
8153fb8 
Signed-off-by: Joe Grandja <10884212+jgrandja@users.noreply.github.com>
@jgrandja jgrandja added the in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) label Feb 11, 2025
@jgrandja jgrandja merged commit 2480d41 into spring-projects:main Feb 11, 2025
6 checks passed
@jgrandja jgrandja deleted the dpop-authn branch February 11, 2025 19:10
This was referenced Feb 11, 2025
Closed
Closed
@jgrandja jgrandja mentioned this pull request Apr 7, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 7, 2025
@jgrandja
Add AuthenticationEntryPoint for DPoP
9c073db 
Issue gh-16574

Closes gh-16900
@jgrandja jgrandja mentioned this pull request Apr 10, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 10, 2025
@jgrandja
Make DPoP IatClaimValidator public to allow configuring clock and clo…
1ca33ca 
…ckSkew

Issue gh-16574

Closes gh-16921
@jgrandja jgrandja mentioned this pull request Apr 14, 2025
Closed
jgrandja added a commit that referenced this pull request Apr 14, 2025
@jgrandja
Prevent downgraded usage of DPoP-bound access tokens
791feee 
Issue gh-16574

Closes gh-16937
This was referenced May 7, 2025
Closed
Closed
@everflux everflux mentioned this pull request Jun 14, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@jgrandja jgrandja

Labels

in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement

Projects

None yet

Milestone

6.5.0-M2

Development

Successfully merging this pull request may close these issues.

1 participant

@jgrandja