PresentedProofs
in package
What the caller proved about **this** connection and **this** request, for {@see JwksVerifier::verifyTokenBinding()}.
A value object rather than two string parameters on purpose: two same-typed nullable thumbprints are exactly the pair a positional call transposes silently, and transposing them would check each proof against the wrong confirmation.
Table of Contents
Properties
- $certificateThumbprint : string|null
- $dpopThumbprint : string|null
Methods
- __construct() : mixed
- certificate() : self
- Only a client certificate was presented.
- dpop() : self
- Only a verified DPoP proof was presented.
- none() : self
- Neither proof — the ordinary bearer case.
Properties
$certificateThumbprint read-only
public
string|null
$certificateThumbprint
= null
$dpopThumbprint read-only
public
string|null
$dpopThumbprint
= null
Methods
__construct()
public
__construct([string|null $certificateThumbprint = null ][, string|null $dpopThumbprint = null ]) : mixed
Parameters
- $certificateThumbprint : string|null = null
-
The peer certificate's RFC 8705 §3.1
x5t#S256, taken from the TLS connection ($_SERVER['SSL_CLIENT_CERT']) or from a trusted terminating proxy over a channel your application controls. Never* from a caller-settable request header: a forgeable input makes the whole mechanism decorative. - $dpopThumbprint : string|null = null
-
The
jktof an already verified DPoP proof. Supply it only after checking the proof's signature,htm,htu,iatandjtifor this request — DpopVerifier::verifyProof() does all ten §21.7.2 checks and returns exactly this value. A thumbprint lifted off an unverified proof would let a proof captured from any other endpoint authorize this one.
certificate()
Only a client certificate was presented.
public
static certificate(string $thumbprint) : self
Parameters
- $thumbprint : string
-
The peer certificate's
x5t#S256.
Return values
self —A pair carrying only the certificate thumbprint.
dpop()
Only a verified DPoP proof was presented.
public
static dpop(string $thumbprint) : self
Parameters
- $thumbprint : string
-
The
jktof an already verified proof.
Return values
self —A pair carrying only the DPoP thumbprint.
none()
Neither proof — the ordinary bearer case.
public
static none() : self
Return values
self —A pair with both thumbprints absent.