Class PushedAuthorizationOptions

Namespace

Fdyay.IdentityServer.Configuration

Assembly

Fdyay.IdentityServer.Core.dll

Server-wide settings for pushed authorization requests.

public class PushedAuthorizationOptions

Inheritance

object

PushedAuthorizationOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AllowUnregisteredPushedRedirectUris

Whether a confidential client's pushed request may name a redirect URI it did not register. Defaults to false.

public bool AllowUnregisteredPushedRedirectUris { get; set; }

Property Value

bool

Remarks

Duende's, measured from its 8.0.1 package (RFC 9126 §2.4): a client that authenticated to push has proved who it is, so the redirect URI it pushes is its own word rather than a browser's. Only a client with RequireClientSecret, only for a pushed request and its redemption, and such a client then needs no registered redirect URI at all.

Lifetime

How long a pushed request stays redeemable. Defaults to ten minutes.

public TimeSpan Lifetime { get; set; }

Property Value

TimeSpan

Remarks

Short by design: the window only has to cover the redirect from the client to the browser and on to the authorize endpoint, and a reference value is a bearer credential for the whole request while it lives. A client may shorten it further per request; it may not lengthen it past this.

Required

Whether every client must push its authorization requests. Defaults to false.

public bool Required { get; set; }

Property Value

bool

Remarks

Individual clients can require it on their own with Client.RequirePushedAuthorization; this makes it server-wide, which is what an installation with no legacy clients left should do.