Release Notes: goauth v0.24.0¶
Release Date: 2026-08-23
Overview¶
This release adds a new dpop package implementing RFC 9449 — Demonstrating Proof of Possession (DPoP). DPoP binds OAuth access tokens to a client-held key pair, so a stolen token can't be used without the corresponding private key.
The package was extracted from systemforge/session/dpop so DPoP can be consumed independently of any session layer. It's provider-independent and depends only on the standard library plus golang-jwt/jwt/v5 and google/uuid (both already required by goauth).
Highlights¶
- New
dpoppackage implementing RFC 9449 Demonstrating Proof of Possession
New Features¶
dpop Package (RFC 9449)¶
import "github.com/grokify/goauth/dpop"
// Generate an ES256 key pair for a client
kp, err := dpop.GenerateKeyPair()
if err != nil {
return err
}
// Create a DPoP proof for an HTTP request
proof, err := dpop.CreateProof(kp, http.MethodGet, "https://api.example.com/resource")
if err != nil {
return err
}
req.Header.Set("DPoP", proof)
The package provides:
- ES256 key pairs — generation and JWK/RFC 7638 thumbprints
- Proof creation and parsing — per RFC 9449, with optional access-token binding
- Verification — server-side proof validation
- HTTP middleware — for enforcing DPoP on protected endpoints
Migration¶
DPoP previously lived in github.com/grokify/systemforge/session/dpop. Consumers now import it from goauth:
// Old
import "github.com/grokify/systemforge/session/dpop"
// New
import "github.com/grokify/goauth/dpop"
The package API is unchanged; only the import path moved. systemforge's session layer continues to bind DPoP to sessions, now via goauth/dpop.