This is a demo showing some proof-of-concepts with readily available DPoP implementations.

DPoP is an acronym for “OAuth 2.0 Demonstrating Proof-of-Possession” and it is defined in RFC9449.

This repository accompanies the FOSDEM 2025 talk Using DPoP to use access tokens securely in your Single Page Applications.

This allows you to tinker with the following setups:

• Using DPoP from a single page app (SPA)

  

• Using DPoP with an application in Apache httpd

  

Each sub-folder contains a README.adoc on how to run each of the components.

• Java 21

• Podman

• Node 22

• Container networking mode “host” (only works on Linux, or Podman on Windows)