identityserver-token-security

DPoP (Demonstrating Proof-of-Possession) binds access tokens to client keys by requiring cryptographic proofs on each request. This sender-constrains tokens so they cannot be used without the client's private key.

Configure DPoP token binding in Duende IdentityServer by enabling DPoP validation settings to require proof-of-possession on access token requests. This cryptographically binds tokens to client keys to prevent misuse.

PAR protects authorization request parameters by pushing them directly to the authorization server via a back-channel POST request, preventing parameter tampering and leakage through the front channel.

mTLS token binding cryptographically links access tokens to the client's TLS certificate. The authorization server validates the certificate fingerprint on each request, rejecting tokens presented without the matching certificate.

FAPI 2.0 enforces stricter security profiles than standard OAuth, including mandatory sender-constraining of tokens, PAR, JAR, and specific algorithm requirements to meet regulatory demands in finance and healthcare sectors.

DPoP binds tokens to client keys via cryptographic proofs in application headers, while mTLS binds tokens to client certificates at the transport layer. Both prevent token replay but operate at different network layers.