Struct DpopVerifier

pub struct DpopVerifier {
    pub allowed_clock_skew: Duration,
    /* private fields */
}

Verifies DPoP proof JWTs.

Fields

allowed_clock_skew: Duration

Implementations

impl DpopVerifier

pub fn new(jti_tracker: Arc<dyn DpopReplayStore>) -> Self

pub fn new_async(replay_store: Arc<dyn AsyncDpopReplayStore>) -> Self

Construct a verifier with an asynchronous replay store.

pub fn verify( &self, dpop_header: &str, access_token: &str, htm: &str, htu: &str, expected_jkt: &str, ) -> Result<()>

Verify a DPoP proof.

• dpop_header: the DPoP header value (compact JWS)
• access_token: the access token bound to this DPoP proof. Used only to compute the ath claim (RFC 9449 §4.2: SHA-256 base64url-no-pad).
• htm: HTTP method (e.g. POST)
• htu: HTTP URI (must match exactly, RFC 9449 §4.2 strict equality)
• expected_jkt: the JWK SHA-256 thumbprint (RFC 7638) of the public key the access token is bound to. Extracted from the access token’s cnf.jkt claim by the caller. Required — DPoP without a known jkt cannot establish proof-of-possession.

Errors

Returns AuthError::DpopInvalid on any structural, alg, or jkt problem, AuthError::DpopReplay on jti reuse, or AuthError::DpopCapacityExceeded if replay tracking is full.

pub async fn verify_async( &self, dpop_header: &str, access_token: &str, htm: &str, htu: &str, expected_jkt: &str, ) -> Result<()>

Verify a DPoP proof using either sync or async replay storage.

Cryptographic validation remains synchronous; remote replay-state I/O is awaited without blocking an async runtime worker.

Trait Implementations

impl Clone for DpopVerifier

fn clone(&self) -> DpopVerifier

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.