spring-projects / spring-projects/spring-security
Add possibility to customize refresh token and DPoP binding
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
It should be possible to customize refresh token and DPoP binding, so engineers can use any binding scheme.
Current Behavior
Currently, it is not possible to customize this. Only one scheme is supported: binding through access_token
Context
The DPoP RFC is not specify how to bind refresh token and DPoP link does not specify how to bind the refresh token to DPoP; instead, it leaves this decision to the authorization server.
Currently, I have an authorization server (not using the latest Spring Security version) with custom DPoP logic implemented. In my implementation, I store the DPoP thumbprint inside the refresh token, so I don't need to use the access token for the binding.
It would be very useful to be able to customize the binding (validation) process between DPoP and refresh tokens.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OAuth2RefreshTokenAuthenticationProvider.java at the linked refresh-token and access-token binding logic, then read RFC 9449 section 5.8. Done means the refresh-token/DPoP binding and validation strategy can be customized rather than relying only on the access token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100