DPoP nonces expire and entropy-generation failure is an error

RFC 9449 §8MUSTRoles: authorization_server, resource_server

Requirement as recorded in the ProtocolSoup registry

Server-provided DPoP nonces expire after the configured lifetime and entropy-generation failure is handled as an error rather than emitting a predictable value.

Read §8 in RFC 9449

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestNonceIssuerRejectsOldNonceAfterLongIdlePeriod
./internal/dpop
Pass
TestNonceIssuerFailsClosedWhenEntropyUnavailable
./internal/dpop
Pass

Implementation

backend/internal/dpop/nonce.go

Related requirements

DP-011ath claim equals the hash of the access token

All RFC 9449 requirements · OID4VCI protocol page