OAuth 2.0 Demonstrating Proof of Possession: normative requirements
RFC 9449Read the specification12 requirements tracked in the ProtocolSoup registry
Self-test verdicts
Verdicts are for commit 97df6a8, evaluated .
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Section 4
- DP-001 Not more than one DPoP HTTP request header field §4.3 MUST Pass
- DP-002 All required claims per Section 4.2 contained in the JWT §4.3 MUST Pass
- DP-003 typ JOSE header parameter has the value dpop+jwt §4.3 MUST Pass
- DP-004 alg is a registered asymmetric signature algorithm and not none §4.3 MUST Pass
- DP-005 JWT signature verifies with the jwk JOSE header public key §4.3 MUST Pass
- DP-006 jwk JOSE header parameter does not contain a private key §4.3 MUST Pass
- DP-007 htm claim matches the HTTP method of the current request §4.3 MUST Pass
- DP-008 htu claim matches the request URI ignoring query and fragment §4.3 MUST Pass
- DP-009 nonce claim matches the server-provided nonce value §4.3 MUST Pass
- DP-010 JWT creation time within an acceptable window §4.3 MUST Pass
- DP-011 ath claim equals the hash of the access token §4.3 MUST Pass
Section 8
Related protocol page: OID4VCI