dpop

Documentation

Index

• Variables
• func CreateProof(privateKey *ecdsa.PrivateKey, opts ProofOptions) (string, error)
• func DPoPVerify(c *gin.Context, proof string, jkt string, clockSkew time.Duration, ...) error
• func ExtractJKTFromToken(tokenStr string) (string, error)
• func GenerateECDSAKey() (*ecdsa.PrivateKey, error)
• func JWKThumbprint(jwk *JWK) (string, error)
• func JWKToPublicKey(jwk *JWK) (*ecdsa.PublicKey, error)
• type DPoPClaims
• type DPoPHeader
• type JWK
  • func PublicKeyToJWK(pub *ecdsa.PublicKey) (*JWK, error)
• type ProofOptions
• type VerifyOptions
• type VerifyProofResult
  • func VerifyProof(opts VerifyOptions) (*VerifyProofResult, error)

Variables

var (
	ErrInvalidProof     = errors.New("invalid DPoP proof")
	ErrInvalidProofAlg  = errors.New("invalid algorithm (must be ES256)")
	ErrInvalidProofType = errors.New("invalid typ (must be dpop+jwt)")
	ErrMissingJWK       = errors.New("missing jwk header")
	ErrInvalidHTM       = errors.New("invalid HTTP method (htm)")
	ErrInvalidHTU       = errors.New("invalid HTTP URI (htu)")
	ErrProofNotYetValid = errors.New("proof issued in the future")
	ErrProofExpired     = errors.New("proof expired (too old)")
	ErrInvalidATH       = errors.New("access token hash mismatch")
	ErrJKTMismatch      = errors.New("JKT mismatch")
	ErrInvalidJWT       = errors.New("invalid JWT format")
	ErrMissingCNF       = errors.New("cnf claim missing in access token")
	ErrMissingJKTInCNF  = errors.New("jkt missing in cnf claim")
)

Functions

func CreateProof

func CreateProof(privateKey *ecdsa.PrivateKey, opts ProofOptions) (string, error)

func DPoPVerify

func DPoPVerify(c *gin.Context, proof string, jkt string, clockSkew time.Duration, accessToken string) error

func ExtractJKTFromToken

func ExtractJKTFromToken(tokenStr string) (string, error)

ExtractJKTFromToken -> cnf.jkt

func GenerateECDSAKey

func GenerateECDSAKey() (*ecdsa.PrivateKey, error)

GenerateECDSAKey tạo cặp khoá ECDSA P-256

func JWKThumbprint

func JWKThumbprint(jwk *JWK) (string, error)

JWKThumbprint tính JWK thumbprint (RFC 7638)

func JWKToPublicKey

func JWKToPublicKey(jwk *JWK) (*ecdsa.PublicKey, error)

JWKToPublicKey chuyển JWK về ECDSA public key

Types

type DPoPClaims

type DPoPClaims struct {
	HTU string `json:"htu"`           // HTTP URI
	HTM string `json:"htm"`           // HTTP Method
	ATH string `json:"ath,omitempty"` // Access Token Hash (SHA-256, base64url)
	jwt.RegisteredClaims
}

DPoPClaims are the claims inside a DPoP proof JWT

type DPoPHeader

type DPoPHeader struct {
	Alg string `json:"alg"`
	Typ string `json:"typ"`
	JWK *JWK   `json:"jwk,omitempty"`
}

DPoPHeader is the JWT header with optional JWK

type JWK

type JWK struct {
	Kty string `json:"kty"`
	Crv string `json:"crv"`
	X   string `json:"x"`
	Y   string `json:"y"`
}

JWK represents a JSON Web Key for EC P-256

func PublicKeyToJWK

func PublicKeyToJWK(pub *ecdsa.PublicKey) (*JWK, error)

PublicKeyToJWK chuyển ECDSA public key sang JWK

type ProofOptions

type ProofOptions struct {
	Method      string // HTTP method (GET, POST, ...)
	URI         string // Full request URI
	AccessToken string // Optional: access token to bind
	JTI         string // Optional: custom jti (auto-generated if empty)
}

ProofOptions for creating a proof

type VerifyOptions

type VerifyOptions struct {
	Proof       string        // DPoP proof JWT
	AccessToken string        // Access token (for ath & cnf.jkt binding)
	Method      string        // Expected HTTP method
	URI         string        // Expected URI
	ExpectedJKT string        // JKT từ access token (cnf.jkt)
	ClockSkew   time.Duration // Allowed clock skew (default 5s)
}

VerifyOptions for verifying a proof

type VerifyProofResult

type VerifyProofResult struct {
	Claims *DPoPClaims
	JKT    string // JKT từ proof (cũng là expectedJKT)
}

VerifyProofResult trả về claims và JKT đã verify

func VerifyProof

func VerifyProof(opts VerifyOptions) (*VerifyProofResult, error)

VerifyProof kiểm tra toàn bộ DPoP proof