ath claim equals the hash of the access token
RFC 9449 §4.3MUSTRoles: resource_server
Requirement as recorded in the ProtocolSoup registry
Ensure that the value of the ath claim equals the hash of that access token.
Read §4.3 in RFC 9449Self-test verdict
PassCommit 97df6a8Evaluated
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Tests
- TestValidateProofATHMustMatchAccessToken
./internal/dpop
Pass
Implementation
Related requirements
Also in §4.3
- DP-001Not more than one DPoP HTTP request header field
- DP-002All required claims per Section 4.2 contained in the JWT
- DP-003typ JOSE header parameter has the value dpop+jwt
- DP-004alg is a registered asymmetric signature algorithm and not none
- DP-005JWT signature verifies with the jwk JOSE header public key
- DP-006jwk JOSE header parameter does not contain a private key
- DP-007htm claim matches the HTTP method of the current request
- DP-008htu claim matches the request URI ignoring query and fragment
- DP-009nonce claim matches the server-provided nonce value
- DP-010JWT creation time within an acceptable window