SignedHttpRequest aka PoP (Proof of Possession)

Introduction

Proof-of-Possession (PoP) provides a mechanism to bind (sender-constrain) access_tokens at the application layer. PoP provides mitigation as access_token are only accepted inside a signed envelope. An access_token obtained by an attacker can only be used if the attacker has also obtained the private key associated with the access_token.

A SignedHttpRequest provides a mechanism to bind an http request to a (PoP) token by signing specific parts of the request.

Proof-of-Possession (PoP) represents a concept that can be implemented in many different ways. This implementation of PoP is based on the SignedHttpRequest spec and it's named SignedHttpRequest to make a clear distinction between other existing and future PoP implementations.

SignedHttpRequest is released as another IdentityModel assembly (Microsoft.IdentityModel.Protocols.SignedHttpRequest) and will start appearing with IdentityModel 6+ releases.

Common Issues

Q&A