Class PushedAuthorizationParameters

Namespace

Fdyay.IdentityServer.Hosting

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Serializes the parameters of a pushed authorization request for storage.

public static class PushedAuthorizationParameters

Inheritance

object

PushedAuthorizationParameters

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

Deserialize(string?)

Restores pushed parameters, or null when the record cannot be read.

public static Dictionary<string, string>? Deserialize(string? parameters)

Parameters

parameters string

Returns

Dictionary<string, string>

PresentedByPusher(string?, IReadOnlyDictionary<string, string>)

Whether the client presenting a reference is the one that pushed it (RFC 9126 §4).

public static bool PresentedByPusher(string? presentedClientId, IReadOnlyDictionary<string, string> pushed)

Parameters

presentedClientId string

pushed IReadOnlyDictionary<string, string>

Returns

bool

Remarks

The reference value is a bearer credential — whoever holds it resumes the request it stands for — and this is the check that makes holding it insufficient. Until 0.37.0 there was none: a reference that leaked out of a browser history or a proxy log could be presented by anyone, and the request ran with the pushing client's parameters, so the leak was worth an authorization somebody else started.

A request presenting no client_id at all is refused rather than accepted from the record. It has to be: a check a caller can skip by omitting the parameter it compares is not a check, and RFC 6749 §4.1.1 requires the parameter on an authorization request anyway.

Two resolvers read a reference — the authorize endpoint, which answers the client, and the return-URL parser, which tells the login and consent pages which application is asking. Both call this. A rule applied to one of them would leave the interactive pages naming an application that the request the user is about to approve is not for.

Serialize(IReadOnlyDictionary<string, string>)

Renders the pushed parameters as the record the authorize endpoint will replay.

public static string Serialize(IReadOnlyDictionary<string, string> parameters)

Parameters

parameters IReadOnlyDictionary<string, string>

Returns

string