This is a demo showing some proof-of-concepts with readily available DPoP implementations.
DPoP is an acronym for “OAuth 2.0 Demonstrating Proof-of-Possession” and it is defined in RFC9449.
This repository accompanies the following talks:
-
FOSDEM 2025 talk Using DPoP to use access tokens securely in your Single Page Applications
-
enterJS 2026 talk Token-Diebstahl in OAuth 2.0 Single-Page Applications verhindern mit DPoP (slides)
This allows you to tinker with the following setups:
-
Using DPoP from a single page app (SPA)
-
Using DPoP with an application in Apache httpd
Each sub-folder contains a README.adoc on how to run each of the components.