Add scheme to token authentication and support DPoP scheme

rubyonrails-core
, ,
1

I’d like to extend ActionController::HttpAuthentication::Token so controller authentication methods such as authenticate_or_request_with_http_token can:

  • restrict authentication to a specific authorization scheme
  • yield the normalized request scheme to the authentication block
  • use the configured scheme in the WWW-Authenticate challenge

For example:

  authenticate_or_request_with_http_token(scheme: "DPoP") do |token, options, scheme|
    # scheme == :dpop
  end

My use case is implementing DPoP from RFC 9449 in the application layer. DPoP defines an authorization scheme alongside the Bearer and Token schemes that Rails already recognizes. The application needs to distinguish between these schemes when validating the token and DPoP proof.

I’m not proposing that Rails validate DPoP proofs or implement the rest of RFC 9449. The application would remain responsible for that. This change would only handle the HTTP-level scheme parsing, restriction, and challenge response.

When no scheme is configured, the existing behaviour would remain unchanged.

I have a working implementation here:

https://github.com/rails/rails/compare/main…chad-cole:rails:feature/add-dpop-authorization

2 Likes