axiscommunications / go-dpop Goto Github PK
View Code? Open in Web Editor NEWDPoP for golang clients and servers
License: MIT License
DPoP for golang clients and servers
License: MIT License
No response
When a DPoP is parsed, the JWK thumbprint should only include required members when calculated. See https://datatracker.ietf.org/doc/html/rfc7638#section-3.2
Related lines of code:
Lines 124 to 137 in e3feea2
Create a proof with a JWK containing optional fields, for example:
{
"crv": "P-256",
"ext": true,
"kty": "EC",
"x": "KDVM3aXrYGUgmKyo0q__DdIDVS0AV139ZTba04SKqFQ",
"y": "SC-oR4qLdhmwrjr6PjJ7_LfFpC_BSFUT14LnMtgjHPs"
}
In this example, "ext" should be excluded.
No response
No response
No response
Both resource servers and clients needs to hash bound authorization tokens during a normal DPoP authorization flow. If done incorrectly on either side it will result in a ath
mismatch.
It would be helpful if the dpop-package had a utility function to hash a token according to the specification. Then both clients and resource servers could be confident in that the hash is made according to specification and reduce likelihood that a ath
mismatch will occur.
No response
No response
When calling Parse
you can add a TimeWIndow
to the options. Currently, this TImeWindow
is used both as checking skew for iat
and some kind of expiry check on the iat
. As a user, these are two separate variables which I want to assign different values for.
It also seems that TimeWindow does not affect the exp
of the dpop proof, which seems inconsistent.
In our case we want to have a smaller clock skew compared to the expiration time. It is also very confusing and hard to debug in the case where exp
is set to a value which is a further in the future than iat
+ TimeWindow
.
No response
No response
No response
In parse.go, the htu is string matched to the httpurl string. According to the RFC, it should ignore any query and fragment parts. Quote:
https://datatracker.ietf.org/doc/html/rfc9449#section-4.3-2.9
The htu claim matches the HTTP URI value for the HTTP request in which the JWT was received, ignoring any query and fragment parts.
The offending line(s)
// Check that `htm` and `htu` claims match the HTTP method and URL of the current request.
// This satisfies point 8 and 9 in https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#section-4.3
if httpMethod != claims.Method || httpURL.String() != claims.URL {
return nil, errors.Join(ErrInvalidProof, ErrIncorrectHTTPTarget)
}
Try to match htu without a query param with a http request url with a query param
No response
No response
No response
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.