Cert pinning blocks capture; you can get past it and mimic works as normal. DPoP is different: it breaks the replay itself, which is the thing mimic does.
A plain app authenticates every request with the same reusable bundle: a bearer token, cookies, device ids. Capture it once, replay it, done. That's mimic.
DPoP (RFC 9449) doesn't work that way. Every request carries a fresh
DPoP: header, a JWT signed by a private key the client holds, with claims that
tie it to that one request:
| Claim | Ties the proof to | Why a copy fails |
|---|---|---|
htm |
HTTP method | reuse on another verb is rejected |
htu |
request URL | reuse on another endpoint is rejected |
iat |
issue time | server accepts only a few-second window |
jti |
unique id | server caches it; single use |
nonce |
server-issued value | unpredictable, short-lived (§8) |
ath |
the access token | proof is tied to that token |
The access token is bound to the key's thumbprint (cnf.jkt), so a stolen token
does nothing without a matching signature on every request. Copying the header
replays nothing.
You usually can't extract the key, but you might borrow the app's ability to use it. Keep the app running on a device you control, hook its DPoP-signing routine with Frida, and have it mint a fresh proof for each request you want to send. The oracle never touches the key; it uses the app to sign. Whether that's even possible depends on where the key lives:
| Key storage | Extractable? | Replay path |
|---|---|---|
Secure Enclave (P-256, kSecAttrTokenIDSecureEnclave) — recommended, common |
No. A jailbreak gives userland root, not enclave access. | Live Frida oracle only, tethered to the running app |
| Keychain software key (lazier apps) | Yes, on a jailbroken device (keychain-dumper, or a Frida SecItemCopyMatching hook) |
Dump the key, sign proofs offline in Python |
Fingerprint the target first: dump the keychain and check whether the DPoP key is Secure-Enclave-backed or a plain software key. That answer decides the rest.
A working oracle still can't do offline replay if the server uses nonces
(RFC 9449 §8). They're server-issued, opaque, and short-lived, so you can't
pre-mint proofs. Each request turns into a round trip: send, get a
use_dpop_nonce error with a fresh nonce, sign with it, resend, with the device
online the whole time. Workable for poking an API by hand, not for detached or
bulk replay.
- Software key plus a jailbreak: dump it, port the app's proof construction into Python, sign offline. Works, minus the nonce round trip.
- Secure Enclave: no extraction. The best you get is a live Frida oracle on a tethered jailbroken device, not worth wiring into a general tool.
- No device access: nothing works. There's no network-only path.
No DPoP-specific tooling exists (no Frida script, no mitmproxy addon); you'd build the oracle from generic Frida hooks. Static header replay, which is what mimic is, doesn't carry over to DPoP targets.