Safeguarding Web Applications Against Token Theft: Fortifying Security and Trust
summary
Implementation of DPoP replaces bearer tokens with access tokens bound to a browser keypair so a stolen token alone is useless, proven by generating an asymmetric key in-browser, signing requests with a DPoP proof JWT, and having the server bind the token to the included public key. It uses the Web Crypto generateKey extractable=false option, short IAT windows, server-issued nonces, and subresource integrity (SRI) to prevent JS tampering. IBM data shows credential/token attacks rise ~71% and average breach cost ~$4.5M so these mitigations materially reduce real risk.
AI-written summary · about
chapters (4)
related talks
58mOAuth and the long way to Proof of Possession
51mToken Theft Prevention (dPoP) – Nth Time is the Charm.
01h 00mSupercharging OAuth 2.0 Security
47mOAuth and Proof of Possession - The long way round
46mBearer of Good News
40mAttack & Defend: Protecting Modern Distributed Applications and Components
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows