OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement

--- description: OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement - Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the HTTP client and resource server boundary to prevent token theft and replay attacks. Requires ephemeral, asymmetric hardware-backed or WebCrypto key pairs rotated per session or risk threshold, binding every access and refresh token to a cryptographic key thumbprint (jkt). globs: src/auth/**/*.{ts,tsx}, src/lib/api/**/*.{ts,tsx}, src/middleware/**/*.{ts,tsx}, src/services/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/oauth21-sender-constrained-dpop-key-rotation" --- # OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Falling back to bearer tokens or reusing static, non-rotated private keys without jti replay verification and URI/method binding. ## System Constraints You are a Principal Security Architect enforcing OAuth 2.1 RFC 9449 Sender-Constrained DPoP standard. Mandate asymmetric WebCrypto key pair management, strict DPoP proof generation with htm/htu/jti/iat claims, automated key rotation on rotation thresholds or invalidation challenges, and strict rejection of standard Bearer tokens across high-privilege surfaces. ## Strict Guidelines - Engineers MUST ALWAYS generate DPoP proofs using asymmetric algorithms (ES256, EdDSA, or RS256; ES256 preferred via WebCrypto) and bind them to the exact HTTP method (`htm`) and normalized URI without query parameters (`htu`). - Engineers MUST NOT store long-lived DPoP private keys in unencrypted `localStorage` or serialize private keys across insecure storage mediums; use non-exportable `CryptoKey` handles or platform keystores. - Services MUST validate the DPoP proof's `jti` against a distributed cache (e.g., Redis) within an allowed clock-skew window (max 60-120 seconds) to guarantee replay prevention. - Components NEVER fall back to standard `Authorization: Bearer <token>` headers when interacting with endpoints flagged as DPoP-required; they MUST send `Authorization: DPoP <token>` alongside the `DPoP: <proof-jwt>` header. - Code SHOULD implement proactive key rotation upon token refresh, server-requested rotation nonces via `DPoP-Nonce`, or upon detecting TLS context shifts. ## Bad vs Good Implementations ### Vulnerable Bearer Token Dispatch with Static Key vs. RFC 9449 DPoP Client Implementation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Transmits credentials as standard unconstrained Bearer tokens. Any MITM, XSS, or proxy log leak allows total token impersonation without cryptographic challenge or key proof. ```typescript import axios from 'axios'; // ANTI-PATTERN: Standard bearer tokens can be exfiltrated and replayed by any attacker. // Static key reuse across sessions leaves tokens susceptible to compromise. export async function callProtectedApi(url: string, token: string) { return axios.get(url, { headers: { Authorization: `Bearer ${token}`, }, }); } ``` #### Production Standard (Correct) > **Standard**: Implements RFC 9449 sender-constrained authorization using non-exportable ECDSA P-256 keys, computes correct htm/htu/jti claims, handles dpop-nonce challenges, and enforces 'Authorization: DPoP' token binding. ```typescript import { importJWK, SignJWT, calculateJwkThumbprint } from 'jose'; interface DPoPKeyPair { privateKey: CryptoKey; publicKey: CryptoKey; publicJwk: Record<string, unknown>; } let activeKeyCache: DPoPKeyPair | null = null; // Generate or rotate non-exportable WebCrypto key pair export async function getOrRotateDPoPKey(forceRotate = false): Promise<DPoPKeyPair> { if (!activeKeyCache || forceRotate) { const pair = await crypto.subtle.generateKey( { name: 'ECDSA', namedCurve: 'P-256' }, false, // non-exportable private key ['sign'] ); const publicJwk = await crypto.subtle.exportKey('jwk', pair.publicKey); activeKeyCache = { privateKey: pair.privateKey, publicKey: pair.publicKey, publicJwk }; } return activeKeyCache; } // Create RFC 9449 compliant DPoP proof export async function createDPoPProof( method: string, targetUrl: string, nonce?: string ): Promise<string> { const keyPair = await getOrRotateDPoPKey(); const cleanUrl = targetUrl.split('?')[0].split('#')[0]; const jwt = new SignJWT({ htm: method.toUpperCase(), htu: cleanUrl, ...(nonce ? { nonce } : {}), }) .setProtectedHeader({ alg: 'ES256', typ: 'dpop+jwt', jwk: keyPair.publicJwk, }) .setIssuedAt() .setJti(crypto.randomUUID()); return jwt.sign(keyPair.privateKey); } export async function callDPoPProtectedApi( url: string, dpopBoundAccessToken: string, serverNonce?: string ): Promise<Response> { const proof = await createDPoPProof('GET', url, serverNonce); const response = await fetch(url, { method: 'GET', headers: { Authorization: `DPoP ${dpopBoundAccessToken}`, DPoP: proof, }, }); // Handle server-issued nonce refresh challenge (RFC 9449 Section 8) if (response.status === 401 && response.headers.has('dpop-nonce')) { const newNonce = response.headers.get('dpop-nonce')!; const retryProof = await createDPoPProof('GET', url, newNonce); return fetch(url, { method: 'GET', headers: { Authorization: `DPoP ${dpopBoundAccessToken}`, DPoP: retryProof, }, }); } return response; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement

OAuth 2.1 Sender-Constrained DPoP Proof & Key-Rotation Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces RFC 9449 Demonstrating Proof-of-Possession (DPoP) at the HTTP client and resource server boundary to prevent token theft and replay attacks. Requires ephemeral, asymmetric hardware-backed or WebCrypto key pairs rotated per session or risk threshold, binding every access and refresh token to a cryptographic key thumbprint (jkt). Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Falling back to bearer tokens or reusing static, non-rotated private keys without jti replay verification and URI/method binding. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Falling back to bearer tokens or reusing static, non-rotated private keys without jti replay verification and URI/method binding.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS generate DPoP proofs using asymmetric algorithms (ES256, EdDSA, or RS256

Engineers MUST ALWAYS generate DPoP proofs using asymmetric algorithms (ES256, EdDSA, or RS256; ES256 preferred via WebCrypto) and bind them to the exact HTTP method (`htm`) and normalized URI without query parameters (`htu`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.