OAuth 2.0 DPoP for the Implicit Flow
John Bradley, Brian Campbell, Michael B. Jones · 2000
This specification describes a mechanism for sender-constraining OAuth 2.0 tokens via a proof-of-possession mechanism on the application level. This mechanism allows for the detection of replay attacks with access tokens. This specification compliments and builds upon the mechanisms defined in draft-fett-oauth-dpop, in which access tokens are returned from the token endpoint. In particular, this specification extends the Demonstration of Proof-of-Possession at the Application Layer (DPoP) mechanisms to also be usable with the OAuth 2.0 implicit flow, in which access tokens are returned from the authorization endpoint.