Adding DPoP feature for flutter #667

utkrishtsahu · 2025-10-06T03:52:22Z

feat: Add comprehensive DPoP (RFC 9449) support across all platforms

This commit implements full DPoP (Demonstrating Proof of Possession) support
for the auth0-flutter SDK across Web, Android, and iOS platforms, enhancing
security by cryptographically binding access tokens to clients.

📦 Dependencies Updated

Android: com.auth0.android:auth0:3.10.0
iOS/macOS: Auth0:2.14.0, JWTDecode:3.3.0, SimpleKeychain:1.3.0
Web: @auth0/[email protected]

✨ New Features

Web Platform

Upgraded Auth0 SPA JS SDK from v2.0 to v2.9.0 with unpkg CDN
Added useDPoP constructor parameter to Auth0Web class
Implemented SDK loading verification with timeout handling
Added comprehensive error handling and logging

Android Platform

Upgraded Auth0.Android SDK from v3.9.0 to v3.10.0
Implemented reflection-based DPoP enablement for WebAuthProvider
Added fallback mechanisms for different SDK versions
Enhanced plugin initialization with proper context management

iOS/macOS Platform

Upgraded Auth0.Swift SDK from v2.10.0 to v2.14.0
Upgraded JWTDecode from v3.2.0 to v3.3.0
Upgraded SimpleKeychain from v1.2.0 to v1.3.0
Updated all podspec files (darwin/, ios/, macos/)

📚 Documentation

Added comprehensive DPoP section to README.md (~184 lines)
Included usage examples for all platforms (Web, Android, iOS)
Added configuration requirements and troubleshooting guide
Documented platform-specific features and API usage
Added links to RFC 9449 and Auth0 documentation

🧪 Testing

Added 17 DPoP-specific tests for mobile platforms (30 total)
Added 21 DPoP-specific tests for web platform (68 total)
Fixed test exception type mismatches (WebException)
All 122 tests passing across all platforms

🔧 Technical Changes

Build Configuration

Upgraded Android Gradle to 8.4.0
Upgraded Java compatibility to version 17
Upgraded Kotlin JVM target to 17
Updated compileSdk to 35

🔐 Security Enhancements

Token theft prevention through cryptographic binding
Replay attack protection with fresh DPoP proofs
Cross-platform security consistency
Automatic DPoP proof generation by native SDKs

🚀 Platform Support

✅ Web: Full DPoP support with SPA JS SDK 2.9.0
✅ Android: Full DPoP support with Auth0.Android 3.10.0
✅ iOS: Full DPoP support with Auth0.Swift 2.14.0
✅ macOS: Full DPoP support with Auth0.Swift 2.14.0

arpit-jn · 2025-11-19T07:18:25Z

@claude

pmathew92 · 2025-12-09T13:25:44Z

...id/src/main/kotlin/com/auth0/auth0_flutter/request_handlers/api/UserInfoApiRequestHandler.kt

-        val builder = api.userInfo(request.data["accessToken"] as String)
+        val accessToken = request.data["accessToken"] as String
+        val tokenType = request.data["tokenType"] as? String ?: "Bearer"
+        val builder = api.userInfo(accessToken)


You need to pass the token type to the api.userInfo(accessToken, tokenType)

pmathew92 · 2025-12-09T13:26:09Z

...id/src/main/kotlin/com/auth0/auth0_flutter/request_handlers/api/UserInfoApiRequestHandler.kt

            builder.addParameters(request.data["parameters"] as Map<String, String>)
        }

+        builder.addHeader("Authorization", "$tokenType $accessToken")


No need to add the header here. the android native client will take care of it

pmathew92 · 2025-12-09T13:28:28Z

auth0_flutter/darwin/Classes/AuthAPI/AuthAPIUserInfoMethodHandler.swift

+        let tokenType = arguments[Argument.tokenType] as? String ?? "Bearer"

        client
            .userInfo(withAccessToken: accessToken)


Same as android , tokenType should be passed here to the userInfo call
client .userInfo(withAccessToken: accessToken,tokenType)

pmathew92 · 2025-12-09T13:28:43Z

auth0_flutter/darwin/Classes/AuthAPI/AuthAPIUserInfoMethodHandler.swift

        client
            .userInfo(withAccessToken: accessToken)
            .parameters(parameters)
+            .headers(["Authorization": "\(tokenType) \(accessToken)"])


You can remove this headers here

…oMethodHandler

Adding DPoP feature for flutter

fb1e954

utkrishtsahu requested a review from a team as a code owner October 6, 2025 03:52

utkrishtsahu had a problem deploying to internal October 6, 2025 03:52 — with GitHub Actions Failure

feat(android): Upgrade native SDK to 3.9.0 and adapt to breaking changes

59561ef

arpit-jn had a problem deploying to internal November 19, 2025 07:17 — with GitHub Actions Failure

auth0 deleted a comment from github-actions bot Nov 19, 2025

auth0 deleted a comment from NandanPrabhu Nov 19, 2025

This comment has been minimized.

Sign in to view

This comment was marked as outdated.

Sign in to view

Fix iOS CredentialsManager caching tests

9cdf344

utkrishtsahu had a problem deploying to internal December 9, 2025 11:48 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal December 9, 2025 11:48 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal December 9, 2025 11:48 — with GitHub Actions Failure

Fixing ios CI failure

6c12e93

utkrishtsahu temporarily deployed to internal December 9, 2025 12:46 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal December 9, 2025 12:46 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal December 9, 2025 12:46 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal December 9, 2025 12:46 — with GitHub Actions Failure

pmathew92 reviewed Dec 9, 2025

View reviewed changes

Handling review comments UserInfoApiRequestHandler and AuthAPIUserInf…

2ef754e

…oMethodHandler

utkrishtsahu had a problem deploying to internal December 9, 2025 15:08 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal December 9, 2025 15:08 — with GitHub Actions Inactive

utkrishtsahu had a problem deploying to internal December 9, 2025 15:08 — with GitHub Actions Failure

utkrishtsahu temporarily deployed to internal December 9, 2025 15:08 — with GitHub Actions Inactive

pmathew92 approved these changes Dec 9, 2025

View reviewed changes

utkrishtsahu merged commit d0ab5d2 into main Dec 10, 2025
11 of 13 checks passed

utkrishtsahu deleted the DPoP_upport_flutter branch December 10, 2025 05:16

This was referenced Dec 10, 2025

Release afpi-v2.0.0 #691

Closed

Release afpi-v2.0.0-beta.0 #694

Closed

Release afpi-v2.0.0-beta.1 #695

Merged

Release af-v2.0.0-beta.1 #696

Merged

pmathew92 mentioned this pull request Dec 15, 2025

feat(android): Upgrade native SDK to 3.9.0 and adapt to breaking changes #671

Closed

2 tasks

Adding DPoP feature for flutter #667

Adding DPoP feature for flutter #667

Uh oh!

Conversation

utkrishtsahu commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Dependencies Updated

✨ New Features

Web Platform

Android Platform

iOS/macOS Platform

📚 Documentation

🧪 Testing

🔧 Technical Changes

Build Configuration

🔐 Security Enhancements

🚀 Platform Support

Uh oh!

arpit-jn commented Nov 19, 2025

Uh oh!

This comment has been minimized.

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

pmathew92 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

pmathew92 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

utkrishtsahu commented Oct 6, 2025 •

edited

Loading