Validating DPoP proofs: which replays jti, htm, htu and nonce stop, and which they don't
What a server must check when it receives an OAuth 2.0 DPoP proof JWT, and how far jti, htm, htu, iat and nonce go in limiting replay, based on RFC 9449 alone.
oauthdpopjwtsecurityauthentication