OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail

--- description: OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail - Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all protected endpoints. Mandates cryptographic binding of access tokens to client ephemeral key thumbprints (jkt), strict replay protection with nonce rotation and bounded jitter windows, and verification of HTTP method and URI claims (htm, htu) to eradicate token export and cross-endpoint relay attacks. globs: src/auth/**/*.{ts,tsx}, src/middleware/**/*.{ts,tsx}, src/api/**/*.{ts,tsx}, src/server/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/oauth21-dpop-replay-thumbprint-binding-standard" --- # OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Accepting Unbound Bearer Tokens or DPoP Proofs with Unvalidated Nonces, Missing Thumbprints, or Loose Replay Windows ## System Constraints You are a Principal Security Architect enforcing RFC 9449 OAuth 2.1 Demonstrating Proof-of-Possession (DPoP) standards. Reject any implementation that treats tokens as pure bearer credentials on sensitive operations. You must mandate: 1) Strict verification of the DPoP proof header JWT with typ 'dpop+jwt', matching HTTP method (htm), and normalized absolute URI (htu). 2) Verification that the access token payload includes a cnf.jkt claim strictly matching the SHA-256 JWK thumbprint computed from the DPoP proof header's public key (jwk). 3) Server-issued, stateful/distributed single-use nonces stored with strict TTL and atomic invalidation to prevent replay attacks within a max acceptable skew window of 60 seconds. ## Strict Guidelines - Engineers MUST ALWAYS verify that incoming DPoP proof JWT headers specify typ 'dpop+jwt' and contain an embedded public key (jwk) without private key components. - Engineers MUST ALWAYS compute the canonical RFC 7638 SHA-256 thumbprint of the DPoP public JWK and assert byte-for-byte equality with the access token's cnf.jkt claim. - Engineers MUST ALWAYS validate that the proof's 'htm' matches request.method and 'htu' matches the fully qualified canonical request URI without query strings or fragments. - Engineers MUST NOT allow proof 'iat' timestamps to diverge more than 60 seconds from server reference clock, and MUST track proof 'jti' identifiers in an atomic replay cache. - Services MUST issue a 'DPoP-Nonce' challenge header with HTTP 401 when a proof nonce is missing, stale, or already consumed, enforcing atomic nonce consumption via Redis or equivalent. - Components NEVER store exportable private keys in persistent client-side storage; private keys MUST reside strictly in non-extractable WebCrypto CryptoKey interfaces or HSM-backed hardware modules. ## Bad vs Good Implementations ### Strict RFC 9449 DPoP Token and Proof Verification Middleware #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The middleware accepts pure bearer tokens susceptible to exfiltration and replay. It fails to require the DPoP header, fails to validate the cryptographic thumbprint binding (cnf.jkt), does not bind requests to HTTP method/URI, and completely omits replay protection. ```typescript import { Request, Response, NextFunction } from 'express'; import jwt from 'jsonwebtoken'; // ANTI-PATTERN: Verifies standard Bearer token without DPoP binding, // ignores replay window, and lacks proof thumbprint validation export async function authenticateRequest(req: Request, res: Response, next: NextFunction) { const authHeader = req.headers.authorization; if (!authHeader?.startsWith('Bearer ')) { return res.status(401).json({ error: 'Missing bearer token' }); } const token = authHeader.substring(7); try { const decoded = jwt.verify(token, process.env.JWT_SECRET!); req.user = decoded; return next(); } catch (err) { return res.status(401).json({ error: 'Invalid token' }); } } ``` #### Production Standard (Correct) > **Standard**: Adheres completely to RFC 9449: validates the 'DPoP' scheme, verifies the DPoP proof using the embedded header public key, calculates and matches the RFC 7638 SHA-256 thumbprint against 'cnf.jkt', enforces HTTP method/URI binding, limits timestamp skew to 60 seconds, and invalidates 'jti' atomically in Redis to prevent replay attacks. ```typescript import { Request, Response, NextFunction } from 'express'; import { jwtVerify, importJWK, calculateJwkThumbprint, JWK } from 'jose'; import { Redis } from 'ioredis'; interface AuthenticatedRequest extends Request { user?: unknown; dpopJkt?: string; } const redis = new Redis(process.env.REDIS_URL!); const MAX_CLOCK_SKEW_SEC = 60; export async function verifyDPoP(req: AuthenticatedRequest, res: Response, next: NextFunction) { const authHeader = req.headers.authorization; const dpopProof = req.headers['dpop'] as string | undefined; if (!authHeader?.startsWith('DPoP ') || !dpopProof) { return res.status(401).json({ error: 'invalid_token', message: 'DPoP authentication required' }); } const rawAccessToken = authHeader.substring(5); try { // 1. Verify Access Token signature and extract thumbprint binding const asPublicKey = await importJWK(JSON.parse(process.env.AS_PUBLIC_JWK!), 'RS256'); const { payload: tokenClaims } = await jwtVerify(rawAccessToken, asPublicKey); const expectedJkt = (tokenClaims.cnf as { jkt?: string })?.jkt; if (!expectedJkt) { return res.status(401).json({ error: 'invalid_token', message: 'Token missing cnf.jkt binding' }); } // 2. Decode and verify DPoP Proof JWT const [headerB64] = dpopProof.split('.'); const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf-8')) as { typ: string; alg: string; jwk: JWK; }; if (header.typ !== 'dpop+jwt' || !header.jwk) { return res.status(400).json({ error: 'invalid_dpop_proof', message: 'Malformed DPoP header' }); } // 3. Match calculated JWK thumbprint against token cnf.jkt const computedJkt = await calculateJwkThumbprint(header.jwk, 'sha256'); if (computedJkt !== expectedJkt) { return res.status(401).json({ error: 'invalid_grant', message: 'JWK thumbprint mismatch' }); } // 4. Verify Proof signature using the ephemeral public key inside the header const proofKey = await importJWK(header.jwk, header.alg); const { payload: proofClaims } = await jwtVerify(dpopProof, proofKey, { maxTokenAge: `${MAX_CLOCK_SKEW_SEC}s`, clockTolerance: '5s', }); // 5. Verify HTTP method and URI claims const targetUrl = `${req.protocol}://${req.get('host')}${req.baseUrl}${req.path}`; if (proofClaims.htm !== req.method || proofClaims.htu !== targetUrl) { return res.status(400).json({ error: 'invalid_dpop_proof', message: 'htm or htu mismatch' }); } // 6. Enforce Nonce and Replay Protection const jti = proofClaims.jti as string; if (!jti) { return res.status(400).json({ error: 'invalid_dpop_proof', message: 'Missing jti claim' }); } const isReplay = await redis.set(`dpop:jti:${jti}`, '1', 'EX', MAX_CLOCK_SKEW_SEC * 2, 'NX'); if (!isReplay) { return res.status(401).json({ error: 'use_dpop_nonce', message: 'DPoP proof replayed' }); } req.user = tokenClaims; req.dpopJkt = computedJkt; return next(); } catch { return res.status(401).json({ error: 'invalid_token', message: 'DPoP validation failed' }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail

OAuth 2.1 RFC 9449 DPoP Replay Window and JWK Thumbprint Binding Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces strict RFC 9449 Demonstrating Proof-of-Possession (DPoP) verification across all protected endpoints. Mandates cryptographic binding of access tokens to client ephemeral key thumbprints (jkt), strict replay protection with nonce rotation and bounded jitter windows, and verification of HTTP method and URI claims (htm, htu) to eradicate token export and cross-endpoint relay attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting Unbound Bearer Tokens or DPoP Proofs with Unvalidated Nonces, Missing Thumbprints, or Loose Replay Windows Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Accepting Unbound Bearer Tokens or DPoP Proofs with Unvalidated Nonces, Missing Thumbprints, or Loose Replay Windows	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify that incoming DPoP proof JWT headers specify typ 'dpop+jwt' and contain an embedded public key (jwk) without private key components.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.