feat: sender-constrained tokens with DPoP (RFC 9449)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- typescript
- 领域
- api, authentication, security
调研方向
Start by reading RFC 9449 and the project plan in #392 to understand the intended DPoP support. Then locate the token endpoint and its client policy and token issuance paths; the issue names no files or tests. Done means refresh tokens are bound to the presenting key, required clients are refused without a proof, and server nonces limit proof replay.
由索引模型根据 Issue 内容生成。
描述
Why
A refresh token held by a desktop, mobile or single-page app is a bearer credential: anyone who copies it can use it. Rotation with reuse detection limits the damage after the fact. Sender-constrained tokens prevent it, because a token is only usable with a private key the client holds, ideally one that cannot leave the device (a TPM, Secure Enclave or platform keystore). RFC 9700 recommends sender constraint for public clients' refresh tokens, and #392 lists DPoP for v2.1 without a ticket yet.
What
- DPoP (RFC 9449) at the token endpoint: a client presents a DPoP proof, and the access and refresh tokens are bound to its key (
cnf.jkt). - Per-client policy: DPoP optional, or required (for example, required for every public client).
- Server nonces (
DPoP-Nonce) to limit proof replay. - Resource servers and adapters verify the proof and the binding (tracked in the adapter repos).
- Notes for clients on holding the key in hardware where the platform allows it: a TPM on Windows and Linux, the Secure Enclave on macOS and iOS, StrongBox on Android.
Done when
A refresh token issued to a DPoP client cannot be used without a proof from the same key, and a client with DPoP required is refused without one.
- 主要语言
- TypeScript
- 星标
- 2
- 派生
- 2
- 平均合并
- 11 小时 40 分钟
- 30 天内合并 PR
- 104
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
fells-code/seamless-auth-api 的其他 Issue
-
easy P2 v0.23
难度 4/5 一周以上 新手友好度 8/100
fells-code/seamless-auth-api#561 ·
维护者通常 1 天内回复
-
epic P1 security v0.23
难度 5/5 一周以上 新手友好度 8/100
fells-code/seamless-auth-api#558 ·
维护者通常 1 天内回复
-
P1 security v0.23
难度 3/5 半天 新手友好度 55/100
fells-code/seamless-auth-api#553 ·
维护者通常 1 天内回复
-
epic P2 v0.23
难度 5/5 一周以上 新手友好度 5/100
fells-code/seamless-auth-api#551 ·
维护者通常 1 天内回复
-
P3 secure v1.0
难度 3/5 1-2 天 新手友好度 55/100
fells-code/seamless-auth-api#439 ·
维护者通常 1 天内回复
查看 fells-code/seamless-auth-api 的全部 Issue
相似的 Issue
-
desktop v3 windows
难度 2/5 1-3 小时 新手友好度 75/100
esengine/DeepSeek-Reasonix#15016 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
readest/readest#7413 · 1 条评论 ·
维护者通常 1 天内回复
-
enhancement good first issue priority: medium size: XS
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复
-
content triage
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
eliasstravik/herdr-projects#788 ·