Scope swapping attacks work because OAuth requests pass through the browser. PAR pushes them over the back channel instead. Here's how it works. #OAuth2 #SpringSecurity #AppSec

A stolen access token is useless with DPoP. RFC 9449 stops token replay attacks, now in Spring Authorization Server 1.5 and Spring Security 7. #SpringSecurity #DPoP #OAuth2

Spring Authorization Server is now part of Spring Security 7. Why? It matured, has a full feature set, and one unified release cycle changes everything. #SpringSecurity #OAuth2 #Java