DPoP replay and nonce stores in production

The default DPoP jti replay cache and DPoP nonce store are single-node, in-memory (ETS / process-local) stores. They are for development and test only. Do not run them in a multi-node deployment.

Why the in-memory stores are dev/test only

DPoP (RFC 9449) defends against proof replay by remembering every jti it has seen within the proof's acceptance window and rejecting a second use (RFC 9449 §11.1). Server-issued DPoP nonces (RFC 9449 §8 / §9) work the same way: the nonce a client must echo is tracked server-side.

An in-memory store remembers only what one node has seen. With two or more nodes behind a load balancer, a replayed proof that lands on a different node than the original is not detected, because that node never saw the first use. The replay protection silently degrades to "per-node," which is no protection at all under any normal load-balancing.

DPoP replay protection is only as strong as the shared store behind it. If the store is not shared across every node that terminates token requests, the protection is not real.

What production requires

Wire a shared store that every node reads and writes:

• Replay check - set :replay_check to a shared implementation. The library ships AttestoPhoenix.Store.EctoReplayCheck, backed by the same Ecto repo as the rest of the token stores:

  replay_check: &AttestoPhoenix.Store.EctoReplayCheck.check_and_record/2

• Nonce store - set :nonce_store to a shared Attesto.DPoP.NonceStore implementation. The library ships AttestoPhoenix.Store.EctoNonceStore:

  nonce_store: AttestoPhoenix.Store.EctoNonceStore

A Redis-backed store is equally valid as long as every node shares it; the contract is "one store, all nodes."

TTL and the sweeper

A shared replay/nonce store accumulates rows that are only relevant for the proof acceptance window. Two things keep it bounded:

• TTL - each recorded jti / nonce carries an expiry tied to the acceptance window. An expired row can never cause a false replay rejection, so it is safe to delete.

• Sweeper - AttestoPhoenix.Store.Sweeper periodically deletes expired rows. Start it under your supervision tree and set the interval via :sweep_interval_ms in AttestoPhoenix.Config:

  sweep_interval_ms: 60_000

  If :sweep_interval_ms is unset the sweeper is not started, and expired rows are retained until you prune them another way.

Checklist

• [ ] :replay_check points at a store shared by every node.
• [ ] :nonce_store points at a store shared by every node.
• [ ] The store's tables are migrated (mix attesto_phoenix.gen.migration).
• [ ] AttestoPhoenix.Store.Sweeper is supervised with :sweep_interval_ms

  set, or another prune mechanism is in place.