Reinstate the check on the 'ath' claim in dpop validation

The current implementation allows the 'ath' claim to be missing. This is done for backwards compatibility with client libraries that do not have this claim in the token.

The 'ath' claim was not part of the original dpop specification draft (https://datatracker.ietf.org/doc/id/draft-ietf-oauth-dpop-01.html section 4.2), but is part of the current draft (https://datatracker.ietf.org/doc/id/draft-ietf-oauth-dpop-11.html at the time of this issue).

When client implementations have caught up with the ath claim, we should start checking for this claim again to align with the newer version of the draft specs.

Suggested plan of attack:

Create ath fix branch
Shortlist application we feel we should support
Research / Test each application against an instance with the ath fix
Open MRs to fix any failing apps (most likely updating used libs sould be enough)
Merge / Deploy the ath fix branch to main

Apps shortlist:

PodPro
Solid Migrator
Media Kraken / Umai / Solid Focus (all use the same lib by Noel de Martin)
Penny
Dokeli
Solid Launcher / Solid Contacts / etc. (all use the same Metro lib)

Others? (for instance from https://solidproject.org/apps)

Navigation Menu

Repository navigation

Reinstate the check on the 'ath' claim in dpop validation #34

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Reinstate the check on the 'ath' claim in dpop validation #34

Description

Activity

Potherca commented on Jun 14, 2026

Potherca commented on Jun 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions