Interface IJwtRequestUriHttpClient
- Namespace
- Fdyay.IdentityServer.Validation
- Assembly
- Fdyay.IdentityServer.AspNetCore.dll
Fetches a JAR request object from the URL a client published it at (RFC 9101 §5.2.2).
public interface IJwtRequestUriHttpClientRemarks
This is the half of JAR that makes an outbound request to a location the client chose, so it is the
half that carries risk: an authorization request naming an internal address would have this server fetch it.
It is gated behind EnableJwtRequestUri, which defaults to off, and the default implementation refuses
anything that is not absolute HTTPS.
A seam so a host can impose its own egress policy — an allow-list of client-registered hosts, a proxy — without reimplementing the signature checking that is the security-relevant half.
Methods
GetAsync(string, CancellationToken)
Fetches the request object, or null when it cannot be retrieved or is not acceptable.
Task<string?> GetAsync(string url, CancellationToken cancellationToken = default)Parameters
urlstringcancellationTokenCancellationToken