Documentation
¶
Overview ¶
Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with.
DPoP binds a token to a key the client holds. The issuer writes the key's thumbprint into the token as "cnf.jkt", and with every request the client sends a proof -- a short JWT signed by that key, naming the request's method and URL and the token's hash -- so that a copy of the token, taken from a log, a proxy or a service that received it, is worth nothing to whoever lacks the key. Nothing here is required of anyone: a token without the binding is a bearer token, as before.
Index ¶
Constants ¶
const ( // HeaderName is the request header a proof travels in (RFC 9449 §4.1). Go canonicalises it to // "Dpop", which http.Header's methods account for and a lookup by map key does not. HeaderName = "DPoP" // Scheme is the authentication scheme a bound token is presented under (RFC 9449 §7.1). Scheme = "DPoP" // Type is what a proof must say it is, in its JWS header. Type = "dpop+jwt" // Algorithm is the one signature algorithm a proof may use. P-256 is what Android Keystore, the // cloud key managers and WebCrypto all hold; a second algorithm would be a second way of reading // a key from someone the service does not know yet, for no client that needs it. Algorithm = "ES256" WwwAuthenticateHeaderName = "WWW-Authenticate" )
const ( ErrorInvalidRequest = "invalid_request" ErrorInvalidToken = "invalid_token" ErrorInsufficientScope = "insufficient_scope" ErrorInvalidDpopProof = "invalid_dpop_proof" )
The error codes a challenge carries: the first three are RFC 6750 §3.1's, which RFC 9449 §7.1 reuses for the DPoP scheme, and the last is RFC 9449's own, for a proof that is missing or wrong.
Variables ¶
This section is empty.
Functions ¶
func AccessTokenHash ¶
AccessTokenHash is a proof's "ath": the base64url encoding, without padding, of the SHA-256 hash of the access token as it was sent (RFC 9449 §4.2).
func BearerChallenge ¶
BearerChallenge renders a Bearer challenge (RFC 6750 §3), for an endpoint that takes either scheme and so names both in its refusals. It is here rather than taken from utils_go because the version this module builds against has no renderer of its own.
Only RFC 6750's codes are carried: "invalid_dpop_proof" means nothing to a bearer client, which is answered with the bare scheme instead.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package testing makes the keys and proofs that tests of DPoP need.
|
Package testing makes the keys and proofs that tests of DPoP need. |
|
types
|
|
|
memory_replay_detector
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused.
|
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused. |
|
proof_key
Package proof_key reads the public key a DPoP proof carries in its "jwk" header.
|
Package proof_key reads the public key a DPoP proof carries in its "jwk" header. |
|
proof_verifier
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to.
|
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to. |
|
proof_verifier/proof_verifier_config
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice.
|
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice. |
|
token_extractor
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under.
|
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under. |