breaking : Moved the `useDPoP` method in the `WebAuthProvider` class to the login builder class by pmathew92 · Pull Request #914 · auth0/Auth0.Android

pmathew92 · 2026-02-16T10:13:46Z

Description

This PR moves the DPoP (Demonstrating Proof-of-Possession) configuration from a global setting on the WebAuthProvider object to the login Builder class, enabling per-request DPoP configuration.

Motivation

Previously, DPoP was configured globally via WebAuthProvider.useDPoP(context), which meant:

Once enabled, DPoP was "sticky" and affected all subsequent login requests
Configuration couldn't be changed per-request

Changes

Before (v3):

WebAuthProvider
    .useDPoP(context)
    .login(account)
    .start(context, callback)

** After(v4):**

WebAuthProvider
    .login(account)
    .useDPoP(context)
    .start(context, callback)

… builder to scope it to individualk login requests

Copilot

Pull request overview

Moves DPoP configuration from a global WebAuthProvider.useDPoP(...) setting to a per-request WebAuthProvider.login(...).useDPoP(...) builder setting, aligning the API with request-scoped behavior and removing the prior “sticky” global configuration.

Changes:

Removed global WebAuthProvider.useDPoP(context) and added Builder.useDPoP(context) for per-login configuration.
Updated WebAuthProviderTest DPoP-related tests to use the builder-based API and removed the global-instance behavior test.
Updated docs (migration guide + examples) to reflect the new call pattern.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
auth0/src/main/java/com/auth0/android/provider/WebAuthProvider.kt	Removes global DPoP config and adds per-builder DPoP support via `SenderConstraining<Builder>`.
auth0/src/test/java/com/auth0/android/provider/WebAuthProviderTest.kt	Updates DPoP tests to use builder-based configuration and removes obsolete global-instance test.
V4_MIGRATION_GUIDE.md	Documents the breaking API move from global to builder-based DPoP configuration.
EXAMPLES.md	Updates WebAuthProvider DPoP usage example to call `useDPoP(context)` on the login builder.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-16T10:20:24Z

auth0/src/main/java/com/auth0/android/provider/WebAuthProvider.kt

+        public override fun useDPoP(context: Context): Builder {
+            dPoP = DPoP(context)
+            return this
+        }


Because DPoP is now configured per login Builder instance, make sure the authentication flow still survives process death/restoration: WebAuthProvider saves/restores OAuthManager via OAuthManager.toState()/fromState(), but OAuthManager.toState() does not currently persist DPoP and OAuthManagerState/PKCE reconstruction doesn’t re-enable DPoP on the restored AuthenticationAPIClient. This can cause a DPoP-enabled login to resume without DPoP proofs after restore. Consider persisting only a lightweight “DPoP enabled” flag in state and reconstructing/configuring DPoP (without serializing a Context-bearing DPoP instance) when restoring.

Copilot · 2026-02-16T10:20:25Z

V4_MIGRATION_GUIDE.md


+### DPoP Configuration Moved to Builder
+
+The `useDPoP()` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.


The text says the useDPoP() method moved, but the API requires a Context parameter (useDPoP(context) / useDPoP(context: Context)). Updating the inline code reference would avoid implying a zero-arg overload still exists.

Suggested change

The `useDPoP()` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.

The `useDPoP(context: Context)` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.

Nit: should be useDPoP(context: Context) to match the actual signature and avoid implying a zero-arg overload exists.

Copilot · 2026-02-16T10:20:25Z

auth0/src/test/java/com/auth0/android/provider/WebAuthProviderTest.kt

    public fun enablingDPoPWillGenerateNewKeyPairIfOneDoesNotExist() {
        `when`(mockKeyStore.hasKeyPair()).thenReturn(false)
-        WebAuthProvider.useDPoP(mockContext)
-            .login(account)
+        login(account)
+            .useDPoP(mockContext)
            .start(activity, callback)


There’s no test asserting the new per-request behavior (i.e., enabling DPoP on one login builder does not affect a subsequent login call that doesn’t call useDPoP). Adding a regression test for the non-sticky behavior would better cover the API change described in the PR motivation.

sanchitmehtagit · 2026-02-16T10:41:51Z

auth0/src/test/java/com/auth0/android/provider/WebAuthProviderTest.kt

+            intentCaptor.allValues[1].getParcelableExtra<Uri>(AuthenticationActivity.EXTRA_AUTHORIZE_URI)
+        assertThat(secondUri, `is`(notNullValue()))
+        assertThat(secondUri, not(UriMatchers.hasParamWithName("dpop_jkt")))
+    }


utkrishtsahu · 2026-02-16T23:58:40Z

auth0/src/main/java/com/auth0/android/provider/WebAuthProvider.kt

+         * @param context the Android context used to access the keystore for DPoP key management
+         * @return the current builder instance
+         */
+        public override fun useDPoP(context: Context): Builder {


Now that DPoP is scoped to the Builder (no longer on the singleton), the DPoP state won't survive process death. OAuthManager.toState() doesn't persist DPoP, and fromState() restores without it — so a DPoP-enabled login will silently resume without DPoP proofs if the OS kills the activity mid-redirect.

Please add a dpoPEnabled: Boolean flag to OAuthManagerState, persist it in toState(), and reconstruct DPoP(context) in fromState() when the flag is true. No need to serialize the DPoP instance itself (it holds a Context).

Please:

1>Add dpoPEnabled: Boolean = false to OAuthManagerState
2>Set it in toState() based on dPoP != null
3>In fromState(), if dpoPEnabled == true, pass DPoP(context) to the reconstructed OAuthManager

Addressed this

utkrishtsahu · 2026-02-17T00:01:29Z

V4_MIGRATION_GUIDE.md


+### DPoP Configuration Moved to Builder
+
+The `useDPoP()` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.


Nit: should be useDPoP(context: Context) to match the actual signature and avoid implying a zero-arg overload exists.

utkrishtsahu · 2026-02-17T00:04:07Z

auth0/src/test/java/com/auth0/android/provider/WebAuthProviderTest.kt

@@ -2861,8 +2853,7 @@ public class WebAuthProviderTest {

    @Test
    public fun shouldNotAffectLogoutWhenDPoPIsEnabled() {


This test name is now misleading — it no longer enables DPoP at all, it just tests default logout. Consider renaming to shouldNotIncludeDPoPParametersInLogoutURI.

Good catch. This test is no longer required. Removed it

…guration changes

utkrishtsahu

LGTM

breaking : Moved the method in the WebAuthProvider class to the login…

fb019c7

… builder to scope it to individualk login requests

Copilot AI review requested due to automatic review settings February 16, 2026 10:13

pmathew92 requested a review from a team as a code owner February 16, 2026 10:13

Copilot started reviewing on behalf of pmathew92 February 16, 2026 10:14 View session

Copilot AI reviewed Feb 16, 2026

View reviewed changes

Updated a test cases

c8eb947

sanchitmehtagit reviewed Feb 16, 2026

View reviewed changes

sanchitmehtagit previously approved these changes Feb 16, 2026

View reviewed changes

Fixed the failing test

507f0c9

pmathew92 dismissed sanchitmehtagit’s stale review via 507f0c9 February 16, 2026 11:02

sanchitmehtagit previously approved these changes Feb 16, 2026

View reviewed changes

utkrishtsahu requested changes Feb 17, 2026

View reviewed changes

Addressed the review comments for Dpop instance being saved for confi…

dfe218c

…guration changes

pmathew92 dismissed sanchitmehtagit’s stale review via dfe218c February 17, 2026 05:09

utkrishtsahu approved these changes Feb 17, 2026

View reviewed changes

pmathew92 merged commit 7da0c8e into v4_development Feb 17, 2026
6 of 7 checks passed

pmathew92 deleted the SDK-7798 branch February 17, 2026 07:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

breaking : Moved the `useDPoP` method in the `WebAuthProvider` class to the login builder class#914

breaking : Moved the `useDPoP` method in the `WebAuthProvider` class to the login builder class#914
pmathew92 merged 4 commits intov4_developmentfrom
SDK-7798

pmathew92 commented Feb 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

utkrishtsahu Feb 17, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

sanchitmehtagit Feb 16, 2026

Uh oh!

utkrishtsahu Feb 16, 2026

Uh oh!

pmathew92 Feb 17, 2026

Uh oh!

utkrishtsahu Feb 17, 2026

Uh oh!

utkrishtsahu Feb 17, 2026

Uh oh!

pmathew92 Feb 17, 2026

Uh oh!

utkrishtsahu left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		### DPoP Configuration Moved to Builder

		The `useDPoP()` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.

	The `useDPoP()` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.
	The `useDPoP(context: Context)` method has been moved from the `WebAuthProvider` object to the login `Builder` class. This change allows DPoP to be configured per-request instead of globally.

		@@ -2861,8 +2853,7 @@ public class WebAuthProviderTest {

		@Test
		public fun shouldNotAffectLogoutWhenDPoPIsEnabled() {

Conversation

pmathew92 commented Feb 16, 2026

Description

Motivation

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

sanchitmehtagit Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

pmathew92 Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

pmathew92 Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants