Web Security · Senior · Question 32 of 75
What do sender-constrained tokens (for example DPoP) protect against?
- 1Tokens being too large for headers
- 2Users forgetting their passwords
- ✓Correct answer: A stolen access token can't be used by someone who doesn't hold the client's private key
Explanation
With DPoP, each request carries a proof signed by a key the client holds. A bearer token, in contrast, works for anyone who has it.