[DPoP Connector] Verify JTI Uniqueness

[VIHANGAGIT]

Current Limitation

Description
When using DPoP for token binding, the DPoPHeaderValidator does not verify the uniqueness of JTI value of each request. This allows DPoP proofs to be replayed in case they are sent to the same endpoint.

Steps to reproduce

1. Login to console and create an application
2. Setup DPoP connector as mentioned in README
3. Add the DPoP header in token request and get the access token.
4. Start another flow and use the same DPoP header.

Suggested Improvement

Store the JTI values of DPoP headers for it's valid period in the context of target URI. DPoP proof with same URI and a JTI that's recently used should be rejected. The spec's recommendation can be found here.

Version

DPoP Connector Version - 1.0.12

[VIHANGAGIT]

Note

DPoP replay attacks can be mitigated with DPoP proofs that has a short life-span (by verifying iat and exp claims). This is an additional security consideration.