authentication_go

Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with.

Package testing makes the keys and proofs that tests of DPoP need.

Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused.

Package proof_key reads the public key a DPoP proof carries in its "jwk" header.

Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to.

Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice.

Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under.

Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are.

Package testing holds what the tests of the endpoints' logging share.

Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it.

Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on.

Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it.

Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid.

Package session_instructions holds the session instructions a server returns to a browser for a device bound session.

Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider.