Flutter · colveor
DPoP
DPoP binds tokens to a key held on the device, so a stolen token cannot be replayed from elsewhere.
Overview
With enableDpop true (the default), every request except send-otp and resend-otp carries a DPoP header containing a freshly signed proof. Login, register, refresh and later API calls all use the same device key, as Colveor Core requires when its DPoP mode is set to required.
The device key
On first use the package generates an ES256 key and stores it with VoStorage under vo_dpop_ec_jwk. It is cached in memory afterwards. Only the public part (without d) is ever sent.
The proof
| Name | Description |
|---|---|
header | typ: dpop+jwt, alg: ES256, jwk: the public key. |
htm | The HTTP method, uppercased. |
htu | The request URL without query string. |
iat | Issued-at time in seconds. |
jti | A unique UUID v4. |
ath | Base64url SHA-256 of the access token, when one is sent. |
Disabling DPoP
Dart
@override
bool get enableDpop => false;Warning
Only disable DPoP when your backend does not require it.