dpop

Documentation

Index

• Constants
• Variables
• func ForRequest(p Signer, r *http.Request, extraClaims any) (string, error)
• func GenerateKey(label string) (*jose.JSONWebKey, error)
• func GetCnfClaim(claims map[string]any) (string, error)
• func LoadKey(path string) (*jose.JSONWebKey, string, error)
• func SaveKey(folder string, k *jose.JSONWebKey) (string, error)
• func SetCnfClaim(claims map[string]any, thumprint string)
• func Thumbprint(k *jose.JSONWebKey) (string, error)
• type Result
  • func VerifyClaims(cfg VerifyConfig, phdr, httpMethod, httpURI string) (*Result, error)
  • func VerifyRequestClaims(cfg VerifyConfig, req *http.Request) (*Result, error)
• type Signer
  • func NewSigner(s crypto.Signer) (Signer, error)
• type TokenInfo
  • func GetTokenInfo(t string) *TokenInfo
• type VerifyConfig

Constants

const (
	// HTTPHeader header name for DPoP
	HTTPHeader = "DPoP"
	// ContentType value
	ContentType = "application/dpop+jwt"
)

const (
	// DefaultExpiration for the proof
	DefaultExpiration = time.Minute * 10
	// DefaultNotBefore offset for NotBefore
	DefaultNotBefore = -10 * time.Minute
)

const (
	// CnfThumbprint is the claim name for JKT thumbptint
	CnfThumbprint = "jkt"
)

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop-04

Variables

var TimeNowFn = time.Now

TimeNowFn to override in unit tests

Functions

func ForRequest

func ForRequest(p Signer, r *http.Request, extraClaims any) (string, error)

func GenerateKey

func GenerateKey(label string) (*jose.JSONWebKey, error)

GenerateKey returns JSONWebKey to sign JWT

func GetCnfClaim

func GetCnfClaim(claims map[string]any) (string, error)

GetCnfClaim gets DPoP `cnf` claim

func LoadKey

func LoadKey(path string) (*jose.JSONWebKey, string, error)

LoadKey returns *jose.JSONWebKey

func SaveKey

func SaveKey(folder string, k *jose.JSONWebKey) (string, error)

SaveKey saves the key to storage

func SetCnfClaim

func SetCnfClaim(claims map[string]any, thumprint string)

SetCnfClaim sets DPoP `cnf` claim

func Thumbprint

func Thumbprint(k *jose.JSONWebKey) (string, error)

Thumbprint returns key thumbprint

Types

type Result

type Result struct {
	Claims     *jwtgo.Claims
	Key        *jose.JSONWebKey
	Thumbprint string
}

Result is returned from VerifyClaims

func VerifyClaims

func VerifyClaims(cfg VerifyConfig, phdr, httpMethod, httpURI string) (*Result, error)

VerifyClaims returns DPoP claims, raw claims, key; or error

func VerifyRequestClaims

func VerifyRequestClaims(cfg VerifyConfig, req *http.Request) (*Result, error)

VerifyRequestClaims returns DPoP claims, raw claims, key; or error

type Signer

type Signer interface {
	// Sign returns DPoP token
	Sign(ctx context.Context, method string, u *url.URL, extraClaims any) (string, error)
	// JWKThumbprint returns base64 hash of the key
	JWKThumbprint() string
}

Signer specifies an interface to sign HTTP requests with DPoP

func NewSigner

func NewSigner(s crypto.Signer) (Signer, error)

NewSigner creates a DPoP signer that can generate DPoP headers for a request.

type TokenInfo

type TokenInfo struct {
	Token       *jwt.JSONWebToken
	Claims      jwtgo.Claims
	Key         *jose.JSONWebKey
	Thumbprint  string
	CnfJkt      string
	IsPublicKey bool
	IsFresh     bool
}

TokenInfo is returned from GetTokenInfo

func GetTokenInfo

func GetTokenInfo(t string) *TokenInfo

GetTokenInfo returns token info, if it's JWT or nil otherwise

type VerifyConfig

type VerifyConfig struct {
	// ExpectedIssuer validates the iss claim of a JWT matches this value
	ExpectedIssuer string
	// ExpectedSubject validates the sub claim of a JWT matches this value
	ExpectedSubject string
	// ExpectedAudience validates that the aud claim of a JWT contains this value
	ExpectedAudience string
	// ExpectedNonce validates that the nonce claim of a JWT contains this value
	ExpectedNonce string
	// EnableQuery speciies to get `dpop` header from the QueryString
	EnableQuery bool
}

VerifyConfig expreses the possible options for validating a JWT