-
Notifications
You must be signed in to change notification settings - Fork 167
Closed
Description
Issue and Steps to Reproduce
It seems like there is a typo in the jwt.ts file where setting the claim
`export const generateJwtDemonstratingProofOfPossessionAsync = (jwk, method = 'POST', url: string, extrasClaims={}) => {
const claims = {
// https://www.rfc-editor.org/rfc/rfc9449.html#name-concept
jit: btoa(guid()),
htm: method,
htu: url,
iat: Math.round(Date.now() / 1000),
...extrasClaims,
};
// @ts-ignore
return JWK.thumbprint(jwk).then(function(kid) {
// @ts-ignore
return JWT.sign(jwk, { /*kid: kid*/ }, claims).then(function(jwt) {
// console.info('JWT:', jwt);
return jwt;
});
});
}`
According to spec the claim jit does not exist but it should be jti, this results in invalid jti claim result on all dpop enabled requests
Versions
Screenshots
Expected
Actual
Additional Details
- Installed packages:
Metadata
Metadata
Assignees
Labels
No labels