Class DPoPProofReplayDetectedEvent
- Namespace
- Fdyay.IdentityServer.Events
- Assembly
- Fdyay.IdentityServer.Core.dll
A DPoP proof was presented for a second time.
public class DPoPProofReplayDetectedEvent : Event- Inheritance
-
DPoPProofReplayDetectedEvent
- Inherited Members
Remarks
The twin of RefreshTokenReplayDetectedEvent, and it exists for the reason that one does: a credential presented twice is not a client that is broken, it is somebody using a copy. This server has detected proof replay since 0.17.0 and refused it in silence until 0.38.0, so a proof lifted off the wire and re-presented left nothing for a host to count.
Information rather than Failure, matching the refresh event: the request was refused correctly, and what is worth telling a host is not that a request failed but that a proof exists in two places.
Raised for replay alone, not for every proof this server turns down. A malformed proof is a broken client and a stale one is usually a drifting clock; reporting those under the same name is how the signal that means somebody has a copy stops being a signal.
It names no client, unlike its twin, and that is not an oversight: a proof is validated against the
request it claims to be for, and DPoPProofValidationContext carries no client because nothing in
the validation needs one. A member added here to hold a value the only raise site cannot fill is the
defect §1e catalogues, arriving as a courtesy. What ties this to a caller is what the event service fills
in for every event — the address it came from and the activity it belonged to — which is also what a host
counting replays per source would group on.
Constructors
DPoPProofReplayDetectedEvent()
A DPoP proof presented a second time. It carries no fields of its own; the event service fills in the caller's address and activity.
public DPoPProofReplayDetectedEvent()