liveBook · Manning

Cnf claim

As explained in Secure APIs

A cnf claim is a JWT confirmation claim that conveys information needed to prove possession of an associated cryptographic key or certificate.

A cnf claim is a JWT confirmation claim that binds an access token to information proving possession of an associated key or certificate. The resource server compares that proof with the confirmation data before accepting the token. section 7.5.1 section 7.5.2

Common confirmation methods include:

  • mTLS uses an x5t#S256 member containing the base64url-encoded thumbprint of the client’s X.509 certificate. section 7.5.1
  • DPoP uses a jkt member containing the public-key thumbprint, while each request supplies a newly signed DPoP JWT. section 7.5.2

Certificate-bound access token

A JWT payload can contain "cnf":{"x5t#S256":"bwcK0esc3ACC3DB2Y5_lESsXE8o9ltc05O89jdN-dg2"}. During the TLS handshake, the resource server captures the client certificate and checks that its thumbprint matches the cnf value.

How Secure APIs covers it

How deep it goes
Explains thumbprints, cnf members, handshake comparison, and per-request DPoP validation without detailing full implementation.
Examples
Uses certificate-thumbprint JWT payloads, DPoP JWTs, authorization requests, and DPoP-authorized curl requests.
What it assumes
Assumes basic JWT and token knowledge while introducing certificate thumbprints, mTLS, DPoP, and proof-of-possession behavior.
What you can do after
Operate/configure token validation that matches certificate or key thumbprints and requires valid request-bound proof.
How it connects
Connects JWT, OAuth, mTLS, TLS, X.509 certificates, DPoP, and proof of possession.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.