Feature Request: DPoP

[gtrak]

I haven't found an off the shelf rust solution for validating DPoP proofs, although it seems relatively simple to implement on top of this library. Is it something you would consider?

[rimutaka]

@gtrak , I'm not a maintainer, but would happily help you implement it. One of my projects is always at risk of XSS and having DPOP validation will help.

[Keats]

I had never heard of DPoP before. How big of a change are we talking about?

[gtrak]

I'll get to it within my own codebase this week, and will see how it looks on top of this lib, but then the next question is if it should be in the library.

Dpop isn't a big change to implement, I hope. It reuses jwt/jwk machinery to check an extra signature on the access token that guarantees the client requested it. I think generating dpop proofs is a little more complex, but I just need to validate them on access tokens.