@bryan-robinson

We are not using DPoP at all, and the app/me call is being made transparently by the FusionAuth Vue SDK, so is not something we can change. That is the default when setting up the VueJS SDK.

I've isolated this to the upgrade to 1.60.0. It has the issue. 1.59.1 works fine.

I suspect it's due to the new tty claim that is included in the at and idt tokens, which did not exist before.

The external JWT reconcile API only returns at and rt tokens. It does not return an idt. So we were setting the at value for the idt cookie. But now that the two tokens can be differentiated, I suspect that this causes the issue.

Was trying to use the Hosted Backend app/refresh API to get refreshed tokens, including an idt, but that is returning a 403-Forbidden for some reason. Documentation on what is required for that API call is rather sparse Says it needs the app.rt cookie, which we have set...but seems it needs more.

@andrzej-taramina Usually, when we see 403s on the hosted backend, the root cause ends up being an origin issue.

The endpoint calls need to originate from the same domain the FusionAuth instance lives at

There's some CORS information in this section of the hosted backend docs: https://fusionauth.io/docs/apis/hosted-backend#prerequisites