Search code examples
authenticationoauth-2.0oauthcors

When to choose: CORS vs DPOP?

While CORS and DPOP very different mechanisms, don’t they effectively do the same thing?

i.e. prevent unauthorized access to a resource server?

Why choose one over the other?

Solution

  • CORS does not prevent anything. It's used to selectively reduce security and allow servers to tell clients on other origins which requests they are allowed to make.

    dPop is a way for a client to proof that they hold a private key when authenticating with OAuth2, without disclosing the key.

    They are completely different mechanisms, and mostly unrelated. Lots of security features ultimately help prevent things from being "stolen", but you can't cafeteria-style pick the security feature you like. Chances are you need to be aware of all of them. Most are complimentary and the ones that are redundant are typically still used anyway (see 'Security in Depth')