bretton.dev / coves
A community based topic aggregation platform built on atproto
Star
Fork 0
Watch

feat(auth): implement DPoP token binding (RFC 9449) master

Add proof-of-possession verification for OAuth access tokens: - DPoPVerifier for validating DPoP proof JWTs - NonceCache for replay attack prevention with background cleanup - JWK thumbprint calculation per RFC 7638 - Support for ES256 signing algorithm - Configurable clock skew and proof age limits Security features: - Validates htm (HTTP method) and htu (HTTP URI) claims - Enforces iat freshness within 5-minute window - Tracks jti values to prevent proof reuse - Calculates and validates JWK thumbprints for token binding 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Author Bretton Co-author Claude Date Commit 6c476298 Parent 38e4cee1
+1405
2 changed files