Documentation
¶
Overview ¶
Package dpop verifies the ES256/P-256 profile of RFC 9449 sender proofs. Proofs establish possession of a key, never user identity or authorization.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidProof = errors.New("invalid DPoP proof") ErrReplay = errors.New("DPoP proof already used") )
Functions ¶
func VerifyRequest ¶
func VerifyRequest(r *http.Request, requestURL, accessToken string, expected *[32]byte, replay ReplayGuard) ([32]byte, error)
VerifyRequest verifies exactly one DPoP header against a trusted public URL, the request method and the presented access token. expected is the access token's cnf.jkt; nil is allowed only when binding a newly issued token to the proof's key. AuthKit requires ath even on authenticated delegation mints. Call only after authenticating the access token. requestURL must come from server configuration or trusted routing, never unvalidated forwarding headers.
Types ¶
type ReplayGuard ¶
ReplayGuard atomically claims key until ttl elapses. It returns true only for the first claim. All receiver replicas must share the same store. Errors must fail closed; implementations must not evict live claims to admit others. Keys are fixed-size SHA-256 digests; ttl is at most 121 seconds.
Source Files