Interface IRequestObjectValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Resolves a JWT-Secured Authorization Request (JAR, RFC 9101) into the parameters it carries.

public interface IRequestObjectValidator

Remarks

A client that signs its authorization request gets integrity over what it signs: a user, or anything sitting between the client and this server, cannot edit a signed scope, redirect URI or response type on the way through. That is the point, and it is why a signed value replaces the query string's on a collision rather than giving way to it.

Methods

ValidateAsync(Dictionary<string, string>, CancellationToken)

Resolves any request object, returning the parameters unchanged when there is none.

Task<RequestObjectResult> ValidateAsync(Dictionary<string, string> parameters, CancellationToken cancellationToken = default)

Parameters

parameters Dictionary<string, string>

cancellationToken CancellationToken

Returns

Task<RequestObjectResult>

ValidateBackChannelAuthenticationRequestAsync(string, Client, CancellationToken)

Verifies a signed CIBA authentication request (CIBA Core §7.1.1) from an already authenticated client and returns the parameters it carries, in Values.

Task<RequestObjectResult> ValidateBackChannelAuthenticationRequestAsync(string requestObject, Client client, CancellationToken cancellationToken = default)

Parameters

requestObject string

client Client

cancellationToken CancellationToken

Returns

Task<RequestObjectResult>

Remarks

The same signature, issuer, audience, lifetime and algorithm checks as a JAR object, plus two a backchannel request needs and a front-channel one does not: a jti, and that the jti has not been seen before. A JAR object travels through a browser once; a CIBA request is a direct call a client could simply repeat, and each repeat makes somebody's phone buzz.