InMemoryJtiStore
in package
implements
JtiStore
FinalYes
A {@see JtiStore} for a single PHP process.
Per-process, and on a classic PHP-FPM runtime that means per-request — the array does not survive the response, so this store prevents no replay at all under FPM. It is useful on a long-running runtime (Swoole, RoadRunner, a CLI worker), and even there it is per-worker: four workers give an attacker four chances to replay a proof inside its freshness window.
Any deployment that actually needs replay protection wants a shared store
(Redis SET key NX EX, a unique index on a database table) behind the same
JtiStore interface.
Table of Contents
Interfaces
- JtiStore
- CONTRACT.md §21.7.2 check 8 — single-use `jti` tracking for DPoP proofs.
Methods
- claim() : bool
- Record `$jti` as used until `$expiresAtUnix`.
Methods
claim()
Record `$jti` as used until `$expiresAtUnix`.
public
claim(string $jti, int $expiresAtUnix) : bool
Parameters
- $jti : string
-
The proof's
jticlaim. - $expiresAtUnix : int
-
When the entry may be forgotten (UNIX seconds).
Return values
bool —true if this is the first sighting, false if it is a replay.