Enum DPoPTokenExpirationValidationMode

Namespace

Fdyay.IdentityServer.Models

Assembly

Fdyay.IdentityServer.Core.dll

How a DPoP proof is held to a time (RFC 9449 §11.1): by its own iat, by a nonce this server issued, or both.

public enum DPoPTokenExpirationValidationMode

Fields

Custom = 0

Neither, from the shipped validator: for a host that replaced IDPoPProofValidator with its own.

Iat = 1

The proof's iat, within the client's clock skew. The default.

Nonce = 2

A nonce this server issued, within DPoPOptions.ServerClockSkew.

IatAndNonce = 3

Both.

Remarks

Duende's names and values. Iat trusts the client's clock within Client.DPoPClockSkew; Nonce trusts only this server's, at the price of a round trip — the first request is answered use_dpop_nonce with a DPoP-Nonce header, and the client signs that value into its next proof — and is the defence against proofs generated ahead of time on a device the attacker held briefly.