alg is a registered asymmetric signature algorithm and not none
RFC 9449 §4.3MUSTRoles: authorization_server, resource_server
Requirement as recorded in the ProtocolSoup registry
The alg JOSE Header Parameter indicates a registered asymmetric digital signature algorithm, is not none, is supported by the application, and is acceptable per local policy.
Read §4.3 in RFC 9449Self-test verdict
PassCommit 97df6a8Evaluated
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Tests
- TestValidateProofRejectsAlgNone
./internal/dpop
Pass - TestValidateProofRejectsSymmetricAlg
./internal/dpop
Pass
Implementation
Related requirements
Also in §4.3
- DP-001Not more than one DPoP HTTP request header field
- DP-002All required claims per Section 4.2 contained in the JWT
- DP-003typ JOSE header parameter has the value dpop+jwt
- DP-005JWT signature verifies with the jwk JOSE header public key
- DP-006jwk JOSE header parameter does not contain a private key
- DP-007htm claim matches the HTTP method of the current request
- DP-008htu claim matches the request URI ignoring query and fragment
- DP-009nonce claim matches the server-provided nonce value
- DP-010JWT creation time within an acceptable window
- DP-011ath claim equals the hash of the access token