Scope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec
@dashaun.com
@dashaun.comScope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec
@dashaun.comA stolen access token is useless with DPoP. RFC 9449 stops token replay attacks, now in Spring Authorization Server 1.5 and Spring Security 7. #SpringSecurity #DPoP #OAuth2
@dashaun.comSpring Authorization Server is now part of Spring Security 7. Why? It matured, has a full feature set, and one unified release cycle changes everything. #SpringSecurity #OAuth2 #Java
@habuma.comSecuring an MCP server with an API key is easy, but sometimes you need something more robust. In this recipe, we’ll put OAuth 2.0 to work with Spring AI to secure an MCP server.
