这是indexloc提供的服务,不要输入任何密码
Skip to content

Dpop payload claim invalid value #1247

@sadukar

Description

@sadukar

Issue and Steps to Reproduce

It seems like there is a typo in the jwt.ts file where setting the claim

`export const generateJwtDemonstratingProofOfPossessionAsync = (jwk, method = 'POST', url: string, extrasClaims={}) => {

const claims = {
    // https://www.rfc-editor.org/rfc/rfc9449.html#name-concept
    jit: btoa(guid()),
    htm: method,
    htu: url,
    iat: Math.round(Date.now() / 1000),
    ...extrasClaims,
};
// @ts-ignore
return JWK.thumbprint(jwk).then(function(kid) {
    // @ts-ignore
    return JWT.sign(jwk, { /*kid: kid*/ }, claims).then(function(jwt) {
        // console.info('JWT:', jwt);
        return jwt;
    });
});

}`

According to spec the claim jit does not exist but it should be jti, this results in invalid jti claim result on all dpop enabled requests

Versions

Screenshots

Expected

Actual

Additional Details

  • Installed packages:

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions