Directories
¶
| Path | Synopsis |
|---|---|
|
Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with.
|
Package dpop holds what the parts of DPoP (RFC 9449) share: the names it puts on the wire, the challenges a refusal answers with, and the hash by which a proof names the token it is sent with. |
|
testing
Package testing makes the keys and proofs that tests of DPoP need.
|
Package testing makes the keys and proofs that tests of DPoP need. |
|
types/memory_replay_detector
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused.
|
Package memory_replay_detector remembers the DPoP proofs a process has accepted, for as long as each could still be accepted, so that a second presentation of one is refused. |
|
types/proof_key
Package proof_key reads the public key a DPoP proof carries in its "jwk" header.
|
Package proof_key reads the public key a DPoP proof carries in its "jwk" header. |
|
types/proof_verifier
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to.
|
Package proof_verifier checks a DPoP proof (RFC 9449 §4.3): that it was made, just now, for this request, by the key the token it comes with is bound to. |
|
types/proof_verifier/proof_verifier_config
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice.
|
Package proof_verifier_config sets how a DPoP proof is verified: how old it may be, how far the client's clock may be off, and whether the proofs accepted are remembered so that none is accepted twice. |
|
types/token_extractor
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under.
|
Package token_extractor reads an access token from "Authorization: DPoP" and, unless told otherwise, "Authorization: Bearer", and says which of the two it came under. |
|
Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are.
|
Package log_masking keeps the credentials the authentication endpoints handle out of the log, by telling the log's HTTP context extractor where they are. |
|
testing
Package testing holds what the tests of the endpoints' logging share.
|
Package testing holds what the tests of the endpoints' logging share. |
|
magic_link
|
|
|
Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it.
|
Package pkce checks a Proof Key for Code Exchange (RFC 7636), which ties a one-time code to the party that asked for it: the client sends a hash of a secret when it starts, and the secret itself when it redeems the code, so that a code intercepted on its way back -- by another app claiming the same URI scheme, say -- is worth nothing to whoever intercepted it. |
|
types/active_session_processor
Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on.
|
Package active_session_processor checks, against the database, that a session token an authorizer has accepted may still be acted on. |
|
types/authentication_method
Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it.
|
Package authentication_method names how a session's holder proved who they are, as the "amr" claim carries it. |
|
types/navigation_refresh_handler
Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid.
|
Package navigation_refresh_handler renews an expired session on a navigation to a sign-in page and sends the browser back where it came from, instead of asking someone to sign in again while their authentication is still valid. |
|
types/session_instructions
Package session_instructions holds the session instructions a server returns to a browser for a device bound session.
|
Package session_instructions holds the session instructions a server returns to a browser for a device bound session. |
|
sso
|
|
|
types/endpoint/login_endpoint
Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider.
|
Package login_endpoint starts the authorization code flow: it mints the state and the PKCE code verifier, records them as an oauth flow, and redirects the user to the provider. |
Click to show internal directories.
Click to hide internal directories.