Bearer tokens are reusable. That’s the problem.
In Quarkus 3.32 you can now implement a custom DPoPNonceProvider and stop OAuth token replay attacks properly.
I built a full end-to-end example with:
- DPoP-bound tokens
- Nonce challenge-response
- Replay protection
- Keycloak Dev Services
Full walkthrough:
https://www.the-main-thread.com/p/quarkus-3-32-dpop-nonce-provider-java-replay-protection
DPoP: What It Is, How It Works, and Why Bearer Tokens Aren’t Enough
#bearer #cryptography #dpop #java #oauth #security #token
https://foojay.io/today/dpop-what-it-is-how-it-works-and-why-bearer-tokens-arent-enough/
Blogged: Use client assertions in ASP.NET Core using OpenID Connect, OAuth DPoP and OAuth PAR
#dotnet #aspnetcode #oidc #oauth #par #dpop #identity #duende #aspire #oss #iam #swiyu
This post looks at implement client assertions in an ASP.NET Core application OpenID Connect client using OAuth Demonstrating Proof of Possession (DPoP) and OAuth Pushed Authorization Requests (PAR…
Blogged: Digital Authentication and Identity validation
https://damienbod.com/2025/12/20/digital-authentication-and-identity-validation/
#oidc #identity #iam #swiyu #eid #oauth #dpop #openid #security #ecollecting #authentication #loa #loi #vc #oauth2 #swiss #ch #cybersecurity
#Keycloak 26.4 is out with a lot of new capabilities for your self-hosted #iam:
* #Passkeys
* Client Authentication to use #SPIFFE or #Kubernetes service account tokens
* Simplified deployments across multiple availability zones to boost availability.
* #FAPI 2 Final
* #DPoP: The OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) is now fully supported.
Read more the full release announcement: https://www.keycloak.org/2025/09/keycloak-2640-released
23.2K Posts, 1.4K Following, 2.33K Followers · Tech Princess 👸🏻 Feminist Politicker 💁🏻♀️ Fashionable Woman 💋 Tooling Witch 🛠 🚀 Founder of https://unobvious.technology Pro-Unions 💪🏻 Trans & Queer 🏳️⚧️🏳️🌈 I currently work on Moderation and Trust & Safety tooling for the Fediverse. Contributor to #Mastodon & other projects. You've probably used code I’ve written. Worked on the Fedi in 2018. Berliner on New York time. Advisor to IFTAS (https://about.iftas.org) Bluesky: @[email protected]
Blogged: Experimental alternative flow for OAuth First-Party Applications
https://damienbod.com/2025/06/10/experimental-alternative-flow-for-oauth-first-party-applications/
Markus Eisele
Wednesday Links
Erik C. Thauvin
Foojay.io
damienbod
Alexander Schwartz
Aaron Parecki