Refresh-Token Binding Does Not Protect the Whole Session
Google’s refresh-token-only DPoP binding makes signing-key custody and refresh recovery explicit credential operations. Its Bearer access tokens and application cookies retain separate protection boundaries. This implementation of the existing RFC 9449 standard does not establish whole-session security or industry-wide adoption.
Read the analysis