Interface ISenderConstraintValidator

Namespace: Fdyay.IdentityServer.Validation

Assembly: Fdyay.IdentityServer.AspNetCore.dll

Checks a presented access token against the cnf it carries.

public interface ISenderConstraintValidator

Remarks

This server binds tokens two ways — a DPoP key thumbprint (RFC 9449) and an mTLS certificate hash (RFC 8705) — and for both of them the binding is worth exactly what the resource server checking it is worth. It relayed cnf to third-party resource servers through introspection from the start, and read it at none of its own: a stolen bound token was an ordinary bearer token everywhere this server is itself the resource.

One rule with one owner, because there are two confirmation methods and more than one endpoint that accepts somebody else's access token, and every previous release that wrote such a rule out at each site separately ended up applying it at some of them.

Methods

ValidateAsync(HttpContext, PresentedAccessToken, CancellationToken)

Whether the request presenting presented proves possession of what its cnf binds it to.

Task<SenderConstraintResult> ValidateAsync(HttpContext context, PresentedAccessToken presented, CancellationToken cancellationToken = default)

Parameters

context HttpContext: The request the token was presented on: its DPoP proof, or its client certificate.
presented PresentedAccessToken: The token, its claims, and the scheme it came under.
cancellationToken CancellationToken: Cancels the check.

Returns