spring-projects / spring-projects/spring-security
Consider adding DPoP specific OAuth2ProtectedResourceMetadata parameters
Open
Nobody has claimed this yet.
in: oauth2
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
RFC9728 lists some DPoP specific properties:
- dpop_bound_access_tokens_required
- dpop_signing_alg_values_supported
Currently those properties cannot be directly configured with OAuth2ProtectedResourceMetadata using specific methods (except for using "claim" method of course)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating OAuth2ProtectedResourceMetadata and reviewing how its existing properties are configured, then compare them with the DPoP properties listed in RFC9728. Done means the two named properties can be configured through specific methods rather than only through the generic claim method; add or update focused tests for that metadata behavior if the surrounding code provides them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100