dpop

package

v3.0.0 Latest Latest Go to latest Published: Oct 8, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/truster-dev/truster

Links

Open Source Insights

Documentation ¶

Overview ¶

Package dpop implements strict, reusable DPoP proof cryptographic primitives.

Index ¶

Variables
func ReplayHash(thumbprint, jti, method, target string) [32]byte
func VerifyAccessTokenHash(proof *Proof, token string) error
func VerifyThumbprint(proof *Proof, expected string) error
type Proof
- func ParseAndVerify(compact, expectedAlgorithm, method, expectedURL string, now time.Time) (*Proof, error)
- func ParseAndVerifyBound(compact, method, expectedURL string, now time.Time) (*Proof, error)
type ReplayCache
- func NewReplayCache(maxEntries int) *ReplayCache
- func (c *ReplayCache) Reserve(hash [32]byte, now time.Time) error

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrReplay identifies a proof already accepted by this process.
	ErrReplay = errors.New("DPoP proof replay")
	// ErrReplayCacheFull identifies a cache whose unexpired entries reached its bound.
	ErrReplayCacheFull = errors.New("DPoP replay cache full")
)

Functions ¶

func ReplayHash ¶

func ReplayHash(thumbprint, jti, method, target string) [32]byte

ReplayHash computes the versioned, length-delimited replay-storage key.

func VerifyAccessTokenHash ¶

func VerifyAccessTokenHash(proof *Proof, token string) error

VerifyAccessTokenHash requires and constant-time verifies a proof's ath.

func VerifyThumbprint ¶

func VerifyThumbprint(proof *Proof, expected string) error

VerifyThumbprint constant-time verifies a proof's binding against a stored jkt.

Types ¶

type Proof ¶

type Proof struct {
	Algorithm  string
	Thumbprint string
	JTI        string
	Method     string
	Target     string
	ATH        string
}

Proof is a verified DPoP proof and its replay inputs.

func ParseAndVerify ¶

func ParseAndVerify(compact, expectedAlgorithm, method, expectedURL string, now time.Time) (*Proof, error)

ParseAndVerify parses and verifies a proof under one configured algorithm.

func ParseAndVerifyBound ¶

func ParseAndVerifyBound(compact, method, expectedURL string, now time.Time) (*Proof, error)

ParseAndVerifyBound verifies any supported profile before a separate JKT binding check.

type ReplayCache ¶

type ReplayCache struct {
	// contains filtered or unexported fields
}

ReplayCache is a process-local, capacity-bounded DPoP replay cache.

func NewReplayCache ¶

func NewReplayCache(maxEntries int) *ReplayCache

NewReplayCache creates a replay cache with the supplied hard entry limit.

func (*ReplayCache) Reserve ¶

func (c *ReplayCache) Reserve(hash [32]byte, now time.Time) error

Reserve records a proof for the full acceptance window or rejects its replay.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL