Google Implements DPoP in OAuth 2.0 to Combat Token Theft

infoq.com

Google Implements DPoP in OAuth 2.0 to Combat Token Theft

First seen 30 Oct 2026, 01:43 UTC • •24.9

Article Content

1 / 6

Browse articles

ThreatCluster •October 30, 2026 at 03:45 UTC

•DPoP enhances OAuth 2.0 security against token theft.
•Only refresh tokens are supported; access tokens remain Bearer tokens.
•Client-side implementation complexity increases with DPoP.

Google has introduced support for Demonstrating Proof-of-Possession (DPoP) in its OAuth 2.0 platform to mitigate token theft and replay attacks. DPoP binds tokens to client-generated asymmetric key pairs, making stolen tokens unusable without the corresponding private key. This enhancement is particularly focused on long-lived refresh tokens, which are often exploited for persistent online impersonation. However, access tokens will continue to use the standard Bearer token model due to performance concerns. The implementation requires developers to handle cryptographic keys and timestamps, increasing client-side complexity. DPoP does not protect web application session cookies, which remain vulnerable to malware. Google is also developing Device Bound Session Credentials (DBSC) to address this gap. DPoP is not suitable for multi-agent workflows, and Google recommends using its Cloud Secure Token Service for delegation. The security of the DPoP private key relies on the client’s security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-29

Google announces DPoP support

Google introduced DPoP in its OAuth 2.0 platform to strengthen security against token theft.

2026-10-30

InfoQ reports on DPoP implementation

InfoQ published an article detailing Google's DPoP support and its implications for OAuth 2.0 security.

More articles in this cluster (5)

Threat Graph

9 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Man-in-the-Middle

Malware (2)

NodeStealer
RedLine

Affected Platform (5)

Bearer Tokens
DPoP
OAuth 2.0
Refresh Tokens
TPM Module

Relationships

Malware targets Bearer Tokens
Malware targets DPoP
Malware targets OAuth 2.0
Malware targets Refresh Tokens
Man-in-the-Middle targets Bearer Tokens
Man-in-the-Middle targets DPoP
Man-in-the-Middle targets OAuth 2.0
Man-in-the-Middle targets Refresh Tokens
NodeStealer related to RedLine
NodeStealer related to TPM Module

Following this threat?

Track NodeStealer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What does DPoP do?

DPoP binds tokens to asymmetric key pairs, preventing stolen tokens from being reused.

Which tokens are affected by DPoP?

DPoP is currently supported only for refresh tokens in Google's OAuth 2.0.

What are the client-side requirements for DPoP?

Developers must generate cryptographic keys, handle timestamps and nonces, and construct specific HTTP headers.

Continue Reading

China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…

KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom…