dpop

Overview

This package implements RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession at the Application Layer (DPoP). DPoP provides a mechanism to bind tokens to a particular client instance by proving possession of a private key.

Installation

go get github.com/matoous/authlib/dpop

Example

package main

import (
    "fmt"
    "log"
    "net/http"

    "github.com/matoous/authlib/dpop"
)

func main() {
    // Generate a key pair for DPoP
    keypair, err := dpop.GenerateKeyPair(dpop.ES256)
    if err != nil {
        log.Fatalf("failed to generate key pair: %v", err)
    }

    // Generate a DPoP proof for a request
    proof, err := keypair.GenerateProof(
        "https://api.example.com/resource", // HTU (HTTP URI)
        http.MethodGet,                      // HTM (HTTP Method)
        "",                                   // nonce (if required by server)
        "your-access-token",                 // access token
        nil,                                  // additional claims
    )
    if err != nil {
        log.Fatalf("generate DPoP proof: %v", err)
    }

    // Use the proof in an HTTP request
    req, _ := http.NewRequest(http.MethodGet, "https://api.example.com/resource", nil)
    req.Header.Set("Authorization", "DPoP your-access-token")
    req.Header.Set("DPoP", proof)

    fmt.Printf("DPoP header: %s\n", proof)
}

Documentation

For complete documentation, see the Go package documentation.