OCT. 15, 2026 (英语).
传统的OAuth无记名符号在"finders-keepers"模式下运行，使其易受Infostealer恶意软件(如RedLine,NodeStealer)和Adversary-in-the-Middle(AiTM)攻击。
DPoP(Deventing Profof-Posession)是一个应用程序层的OAuth 2.0安全配置文件(RFC 9449)，它通过加密绑定符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符符
本條目旨在告知您在何地以及如何通过DPoP，并描述Google具体的DPoP执行。 此外，还提供DPoP收养SKILL.md，以帮助执行DPoP。
RFC 9449中的一些可选特征和执行决定被授权给作为授权提供者的Google. Google身份，及其OAuth平台，发挥开发者-造型服务的作用，工程师实施OAuth 2.0和加密安全控制，如DPoP，以保护API集成。 另外，Google工作空间上下文-Aware Access(CAA)利用DPoP通过加密验证Agent Gateway的agent身份，在Gemini企业Agent平台上确保企业AI工作量。
Google的OAuth平台支持DPoP绑定，专门用于刷新令牌。 这种设计选择反映了一种实用的工程权衡：通过发送者-对长寿命的刷新符号进行训练，我们消除了持续线下冒充的主要载体。 同时，短寿命访问符仍然是标准的Bearer令牌，确保高QPS资源API不会发生DPoP每要求的非对称加密验证管理费用。 这种方法为您最敏感的资质提供了有力的保护，同时保持了Google API集成的高性能和低潜性。
与标准Bearer令牌流不同的是，DPoP需要客户端加密密钥生成，严格的时间戳和非ce处理，具体的索赔计算(htm, htu, iat, jti)，精确头部构造，以及DPoP证明JWT构造。 这些变化可能带来额外的系统限制，以支持安全的计算、处理和存储。
IETF OAuth 2.0 安全(RFC 9700)的最佳当前操作，讨论发送者受约束的刷新符号。 此外，基于浏览器的应用程序 IETF 的 OAuth 2.0 草稿讨论三种模式：后端对Frontend(BFF),Token-Mediding Backend，以及基于浏览器的 OAuth 客户端。
根据这一指导，Google建议使用DPoP来在这些模型中发送-连续刷新令牌。
与通常在现代云代理和负载平衡器中断裂或终止的运输级符号绑定(如mTLS/RFC 8705)不同，DPoP在HTTP头级运行。 这使得它对于复杂，多跳的环境，包括新出现的模型背景协议(MCP)和自主的agent架构具有高度的复原力。
来自安全建筑师的一个常见问题是：如果DPoP设计为发送-约束令牌，为什么Google的访问令牌仍然是标准的Bearer令牌？
答案在于Google规模的操作规模和性能。 验证不对称加密签名(如ES256)需要显著的CPU周期。 如果每个高通量的API调用Google资源服务器(如Gmail,Calendar，或Drive API)都需要验证一个DPoP证明，API网关层的计算管理费用将是巨大的，引入了可测量的延迟性和缩放成本。
Google的架构通过将DPoP严格绑定在刷新符上，实现了平衡：
长寿身份证明保护：高度敏感的长寿刷新符(可用于无限获取新的访问符)在密码学上与客户端的密钥对绑定。 如果被揭穿，这对攻击者是无用的。
高性能服务(High-Performance Service)：短寿命访问符(通常有效时间为1小时或更短)仍然是标准的Bearer符。 这保证了绝大多数API请求都会发生零加密校验间接费用，保持了GoogleAPI对高性能和低延迟开发者的期望。
DPoP是获得OAuth 2.0令牌的强大工具，但了解其边界很重要。
DPoP不保护标准网络应用会话 cookie，这仍然是Infostealer恶意软件的首要目标。 为了解决饼干盗窃问题，Google和Web孵化器社区集团(WICG)正在积极开发设备Bound会话证书(DBSC). 虽然DPoP在应用层运行，为公共和机密客户端获取API令牌，但DBSC在浏览器和网络层运行，以加密方式将浏览器会话 cookie绑定在设备的硬件上(如TPM). DPoP和DBSC共同形成了一个针对跨API和基于网络的用户会话的证书盗窃的全面深入防御战略。
随着自主的AI agents和Model Context Protocol(MCP)架构的出现，确保工具使用符号变得至关重要。 虽然DPoP在单跳客户端到服务器的连接中具有高度的弹性，但多agent工作流程(其中Agent A将任务委托给Agent B，称资源C)引入了授权挑战。
在多agent链中，Agent B不能在没有访问Agent A的私人密钥的情况下代表Agent A签署DPop证明——共享私人密钥违反了DPoP的核心安全原则。 因为Google的核心消费者OAuth端点(oauth2.googleapis.com)不支持OAuth 2.0 Token Exchange(RFC 8693)，开发商建立多agent或联云工作量应当考虑Google Cloud Secure Token Service(STS). 通过STS的路由授权，中间的agent可以将上游的令牌换成一个新的，短命的联邦令牌加密方式，将其绑在自己的本地密钥对上，在整个agent链中保持发送-受约束的安全模型而无需密钥曝光。
见我们的DPop领养指南，我们的DPop领养SKILL.md，并改善您的平台安全今天。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
OCT. 15, 2026
Traditional OAuth bearer tokens operate on a "finders-keepers" model, making them vulnerable to Infostealer malware (e.g. RedLine, NodeStealer) and Adversary-in-the-Middle (AiTM) attacks.
DPoP (Demonstrating Proof-of-Possession) is an application-layer OAuth 2.0 security profile (RFC 9449) that neutralizes token theft and replay attacks by cryptographically binding tokens to a client-generated asymmetric keypair at the application layer, ensuring that even if a token is stolen, it cannot be replayed without the corresponding private key.
This article is meant to inform you on where and how to adopt DPoP and describes Google's specific DPoP implementation. A DPoP adoption SKILL.md is also available to help implement DPoP.
Some optional features and implementation decisions in RFC 9449 are delegated to Google as an authorization provider. Google Identity, and its OAuth Platform, function as a developer-facing service where engineers implement OAuth 2.0 and cryptographic security controls like DPoP to protect API integrations. Separately, Google Workspace Context-Aware Access (CAA) leverages DPoP to secure enterprise AI workloads on the Gemini Enterprise Agent Platform by cryptographically validating agent identities at the Agent Gateway.
Google's OAuth Platform supports DPoP binding specifically for refresh tokens. This design choice reflects a pragmatic engineering tradeoff: by sender-constraining the long-lived refresh token, we neutralize the primary vector for persistent offline impersonation. Meanwhile, short-lived access tokens remain standard Bearer tokens, ensuring that high-QPS resource APIs do not incur the per-request asymmetric cryptographic verification overhead of DPoP. This approach delivers robust protection for your most sensitive credentials while maintaining the high performance and low latency of Google API integrations.
Unlike standard Bearer token flows, DPoP requires client-side cryptographic key generation, strict timestamp and nonce handling, specific claim computation (htm, htu, iat, jti), exact header construction, and DPoP proof JWT construction. These changes may introduce additional system constraints to support secure computation, handling, and storage.
The IETF’s Best Current Practice for OAuth 2.0 Security (RFC 9700) discusses sender-constrained refresh tokens. Additionally, the OAuth 2.0 for Browser-Based Applications IETF draft discusses three models: Backend-for-Frontend (BFF), Token-Mediating Backend, and Browser-based OAuth Client.
Following this guidance, Google recommends using DPoP to sender-contrain refresh tokens in these models.
Unlike transport-layer token binding (e.g., mTLS/RFC 8705) which often breaks or terminates at modern cloud proxies and load balancers, DPoP operates at the HTTP header level. This makes it highly resilient for complex, multi-hop environments, including emerging Model Context Protocol (MCP) and autonomous agent architectures.
A common question from security architects is: If DPoP is designed to sender-constrain tokens, why are Google's access tokens still standard Bearer tokens?
The answer lies in operational scaling and performance at Google's scale. Verifying asymmetric cryptographic signatures (such as ES256) requires significant CPU cycles. If every API call to high-throughput Google resource servers (like Gmail, Calendar, or Drive APIs) required verifying a DPoP proof, the compute overhead at the API Gateway layer would be massive, introducing measurable latency and scaling costs.
By constraining DPoP binding strictly to the refresh token, Google's architecture achieves a balance:
Long-Lived Credentials Protected: The highly sensitive, long-lived refresh token (which can be used to obtain new access tokens indefinitely) is cryptographically bound to the client's key pair. If exfiltrated, it is useless to an attacker.
High-Performance Serving: Short-lived access tokens (typically valid for 1 hour or less) remain standard Bearer tokens. This ensures that the vast majority of API requests incur zero cryptographic verification overhead, maintaining the high performance and low latency developers expect from Google APIs.
DPoP is a powerful tool for securing OAuth 2.0 tokens, but it is important to understand its boundaries.
DPoP does not protect standard web application session cookies, which remain a primary target for Infostealer malware. To address cookie theft, Google and the Web Incubator Community Group (WICG) are actively developing Device Bound Session Credentials (DBSC). While DPoP operates at the application layer to secure API tokens for public and confidential clients, DBSC operates at the browser and network layer to cryptographically bind browser session cookies to the device's hardware (such as TPM). Together, DPoP and DBSC form a comprehensive defense-in-depth strategy against credential theft across both API and web-based user sessions.
As autonomous AI agents and Model Context Protocol (MCP) architectures emerge, securing tool-use tokens becomes critical. While DPoP is highly resilient in single-hop client-to-server connections, multi-agent workflows (where Agent A delegates a task to Agent B, which calls Resource C) introduce delegation challenges.
In a multi-agent chain, Agent B cannot sign a DPoP proof on behalf of Agent A without access to Agent A's private key—and sharing private keys violates the core security principles of DPoP. Because Google's core consumer OAuth endpoint (oauth2.googleapis.com) does not support OAuth 2.0 Token Exchange (RFC 8693), developers building multi-agent or federated cloud workloads should consider Google Cloud Secure Token Service (STS). By routing delegation through STS, the intermediate agent can exchange the upstream token for a new, short-lived federated token cryptographically bound to its own local key pair, preserving the sender-constrained security model across the entire agent chain without key exposure.
See our DPoP Adoption Guide, our DPoP adoption SKILL.md, and improve your platform security today.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.