DpopRequest
in package
What {@see DpopVerifier::verifyProof()} needs to know about the current request.
Every field feeds a §21.7.2 check that cannot be made without it — there is no "just check the signature" mode, because that is exactly the partial verification the contract calls worse than none.
Table of Contents
Properties
- $accessToken : string
- $expectedJkt : string|null
- $httpMethod : string
- $httpUri : string
- $leewaySeconds : int
- $nowUnix : int|null
Methods
- __construct() : mixed
- withExpectedJkt() : self
- The same request, with the token's `cnf.jkt` so check 10 runs inside the call.
Properties
$accessToken read-only
public
string
$accessToken
$expectedJkt read-only
public
string|null
$expectedJkt
= null
$httpMethod read-only
public
string
$httpMethod
$httpUri read-only
public
string
$httpUri
$leewaySeconds read-only
public
int
$leewaySeconds
= DpopVerifier::IAT_LEEWAY_SECONDS
$nowUnix read-only
public
int|null
$nowUnix
= null
Methods
__construct()
public
__construct(string $httpMethod, string $httpUri, string $accessToken[, string|null $expectedJkt = null ][, int $leewaySeconds = DpopVerifier::IAT_LEEWAY_SECONDS ][, int|null $nowUnix = null ]) : mixed
Parameters
- $httpMethod : string
-
The request method, e.g.
POST. - $httpUri : string
-
The full request URI. Query and fragment are stripped during comparison, so passing it with a query string is expected.
- $accessToken : string
-
The token from the
Authorizationheader, exactly as it arrived — this is hashed for theathcheck. - $expectedJkt : string|null = null
-
The token's
cnf.jkt, when the caller has it. Supplying it performs check 10 inside the call; leaving it null means the caller must do that comparison itself, which JwksVerifier::verifyTokenBinding() does. - $leewaySeconds : int = DpopVerifier::IAT_LEEWAY_SECONDS
-
The
iatwindow, applied in both directions. - $nowUnix : int|null = null
-
Override for the current time, for tests.
withExpectedJkt()
The same request, with the token's `cnf.jkt` so check 10 runs inside the call.
public
withExpectedJkt(string $jkt) : self
Parameters
- $jkt : string
-
The token's
cnf.jkt.
Return values
self —A copy carrying the expected thumbprint.