# OAuth 2.0 Proof of Possession

- Link: https://www.agilicus.com/oauth-2-0-proof-of-possession/
- Published: 2021-01-06T06:00:00+00:00
- Author: Don Bowman

OAuth 2.0 simplified its problem space by making Proof Of Possession tokens optional,
replacing them with [Bearer tokens](https://tools.ietf.org/html/rfc6750) as the 
standard choice. This was [controversial](https://www.cnet.com/news/oauth-2-0-leader-resigns-says-standard-is-bad/),(
partially) causing one of the authors to quit. But, good news, Proof Of Possession
tokens are [back](https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-07)
for OAuth 2.0.

Now, back to the author who quit. He gave an entertaining talk on how bad OAuth 
2 is. Yes, OAuth 2.0 was designed prior to modern web applications (it viewed the
world through a PHP lens), but, OpenID Connect was built on top of it and we’ve 
moved on.

OK, now that you’ve watched that and are somewhat concerned about your own use of
OAuth 2.0, you are wondering if you should switch from Bearer to PoP. There is also
the in-progress draft for [Demonstration of Proof of Concept](https://www.agilicus.com/access-token-dpop/),
confusing you more.

Well, lets start with the [basics](https://www.agilicus.com/web-security-101-2/).
[Content Security Policy](https://www.agilicus.com/angular-content-security-policy-google-tagmanager/).
[Cross-Site-Scripting](https://www.agilicus.com/stupid-simple-security-trick-add-a-dns-caa-record/).
Once these are in place, evaluate, how can my Bearer (Access) token be stolen? If
you can come up with a reasonable way, fix it. While you are doing that, evaluate
these two drafts on Proof of Possession. As they progress, if they become standard,
adopt.

Is Proof of Possession better? Yes. Is OAuth 2.0 better than “proprietary auth scheme
written by unknown vendor”? Yes. So you are better using a spec which is being improved,
than something hidden which is unknown.