htu claim matches the request URI ignoring query and fragment
RFC 9449 §4.3MUSTRoles: authorization_server, resource_server
Requirement as recorded in the ProtocolSoup registry
The htu claim matches the HTTP URI value for the HTTP request in which the JWT was received, ignoring any query and fragment parts.
Read §4.3 in RFC 9449Self-test verdict
PassCommit 97df6a8Evaluated
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Tests
- TestValidateProofHTUNormalizationEquivalence
./internal/dpop
Pass - TestValidateProofHTUMismatchIsRejected
./internal/dpop
Pass
Implementation
Related requirements
Also in §4.3
- DP-001Not more than one DPoP HTTP request header field
- DP-002All required claims per Section 4.2 contained in the JWT
- DP-003typ JOSE header parameter has the value dpop+jwt
- DP-004alg is a registered asymmetric signature algorithm and not none
- DP-005JWT signature verifies with the jwk JOSE header public key
- DP-006jwk JOSE header parameter does not contain a private key
- DP-007htm claim matches the HTTP method of the current request
- DP-009nonce claim matches the server-provided nonce value
- DP-010JWT creation time within an acceptable window
- DP-011ath claim equals the hash of the access token