2026-09-01 · 7 min read · Rahul Chitturi
- jwt
- oauth
- security
A Demonstrating Proof of Possession proof is a short-lived signed JWT bound to an HTTP request and a client key. A valid access token can still receive an invalid_dpop_proof response when the proof describes a different method, URI, nonce, or key.
Reverse proxies and SDK retries complicate diagnosis because the URI visible to the client may differ from the value reconstructed by the resource server.
Compare the proof with the actual request
Inspect only synthetic or locally generated proofs. Confirm that htm matches the uppercase HTTP method and htu matches the URI form required by the server profile, excluding fragments and usually excluding query and user information.
- Verify typ, alg, and the public JWK in the protected header
- Match the access token cnf thumbprint to the proof key
- Check iat freshness and enforce one-time jti replay tracking
- Retry a nonce challenge with the newest server-provided nonce
Preserve trust across proxies
Define which trusted proxy supplies the external scheme and authority, then reconstruct the target URI consistently. Never accept arbitrary forwarded headers from the public internet merely to make htu comparisons pass.
Nonce retries need bounded loops and a newly signed proof for each request. Reusing the original JWT after a challenge defeats nonce validation and can trigger replay detection.
A Flashman workflow
Use the JWT tool to inspect synthetic claims, URL tool to compare URI components, timestamp converter for iat boundaries, and hash tool to check documented JWK thumbprint fixtures.
Test proxy and direct paths, default ports, redirects, nonce rotation, duplicate requests, clock skew, key mismatch, and the exact OAuth client and resource-server versions.