https://www.infoq.com InfoQ Spring Security Articles feed https://www.infoq.com/articles/spring-security-7-server-side-dpop-token-exchange/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=Spring+Security-articles <img src="https://res.infoq.com/articles/spring-security-7-server-side-dpop-token-exchange/en/headerimage/spring-security-7-server-side-dpop-token-exchange-header-1791884636157.jpg"/><p>Spring Authorization Server now lives inside Spring Security 7 under the same Maven coordinates, so the upgrade is a version bump. This server-side guide covers enabling DPoP and RFC 8693 Token Exchange, explains why 7.1 apps can silently stop enforcing DPoP until they call .dPoP(), and shows how to combine both into narrowed, sender-constrained tokens for service-to-service and agentic calls.</p> <i>By Dhruv Agnihotri</i> Spring Security Java Spring Development Architecture & Design article Thu, 15 Oct 2026 09:00:00 GMT https://www.infoq.com/articles/spring-security-7-server-side-dpop-token-exchange/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=Spring+Security-articles Dhruv Agnihotri 2026-10-15T09:00:00Z /articles/spring-security-7-server-side-dpop-token-exchange/en