IO Wallet SDK
    Preparing search index...

    Function verifyPushedAuthorizationRequest

    • Verifies a pushed authorization request (PAR) including JAR, DPoP, and client attestation.

      This function extends verifyAuthorizationRequest by adding support for JWT-secured Authorization Requests (JAR). It performs comprehensive verification of all security mechanisms used in pushed authorization requests according to RFC 9126 (PAR) and RFC 9101 (JAR).

      The verification process includes:

      1. JAR signing policy enforcement (per RFC 9101 Section 10.5) - validates require_signed_request_object
      2. JAR request object verification (if provided) - validates JWT signature and claims
      3. RFC 9101 §4 claim validation - validates iss, aud, exp, iat claims
      4. IT-Wallet specific validations - iat age limits and key binding with wallet attestation
      5. DPoP proof verification (if provided) - validates proof of possession
      6. Client attestation verification - validates client identity

      JAR Signing Policy (RFC 9101): When authorizationServerMetadata.require_signed_request_object is true:

      • Rejects requests without signed JAR (downgrade attack protection)
      • Rejects JAR with algorithm "none" (security requirement) When false or omitted (default): accepts both signed and unsigned requests

      Important: Use parsePushedAuthorizationRequest first to extract the necessary JWTs from request headers and body.

      Parameters

      • options: VerifyPushedAuthorizationRequestOptions

        The verification options

        • authorizationRequest: { client_id?: string }
        • OptionalauthorizationRequestJwt?: { jwt: string; signer: JwtSigner }

          The authorization request JWT to verify. If this value was returned from parsePushedAuthorizationRequest you MUST provide this value to ensure the JWT is verified.

        • authorizationServerMetadata: { require_signed_request_object?: boolean } & ItWalletAuthorizationServerMetadata

          Authorization Server metadata for enforcing JAR signing policy. Includes standard Authorization Server metadata plus require_signed_request_object. When require_signed_request_object is true, the server will reject unsigned requests. Defaults to false (permissive) if not provided.

          RFC 9101 Section 10.5

        • callbacks: Pick<CallbackContext, "hash" | "verifyJwt">
        • clientAttestation: ClientAttestationOptions
        • config: IoWalletSdkConfig
        • Optionaldpop?: VerifyAuthorizationRequestDPoP
        • Optionalnow?: Date

          The current time to use when verifying the JWTs. If not provided current time will be used.

          new Date()
        • request: RequestLike

      Returns Promise<VerifyPushedAuthorizationRequestReturn>

      A promise resolving to verification results containing:

      • jar - Verified JAR request including decoded payload and signer (if JAR was provided)
      • dpop - Verified DPoP information including JWK and thumbprint (if DPoP was provided)
      • clientAttestation - Verified client attestation JWTs (if client attestation was provided)

      When require_signed_request_object is true but request is unsigned

      When require_signed_request_object is true but JAR uses alg="none"

      When iss claim doesn't match client_id (RFC 9101 §4)

      When aud claim doesn't match authorization server issuer (RFC 9101 §4)

      When exp claim is missing or expired (RFC 9101 §4)

      When iat claim is missing, too old (>5 min), or in future (>60s)

      When kid doesn't match between JAR and wallet attestation cnf.jwk

      When cnf.jwk is missing from wallet attestation

      When JAR JWT verification fails

      When JAR client_id doesn't match request client_id

      When JAR request object is encrypted (not supported)

      When DPoP is required but missing

      When client attestation is required but missing

      When client_id doesn't match between request and client attestation

      When DPoP and client attestation keys don't match (if ensureConfirmationKeyMatchesDpopKey is true)

      When any JWT signature verification fails

      When any JWT is expired or has invalid claims

      // Example 1: Enforce signed JAR (strict mode)
      const result = await verifyPushedAuthorizationRequest({
        authorizationRequest: parsed.authorizationRequest,
        authorizationServerMetadata: {
          issuer: 'https://auth.example.com',
          require_signed_request_object: true  // Reject unsigned requests
        },
        callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
        authorizationRequestJwt: {
          jwt: parsed.authorizationRequestJwt,
          signer: clientSignerFromFederation
        },
        request: httpRequest
      });

      // Example 2: Accept both signed and unsigned (permissive mode)
      const result = await verifyPushedAuthorizationRequest({
        authorizationRequest: parsed.authorizationRequest,
        authorizationServerMetadata: {
          issuer: 'https://auth.example.com',
          require_signed_request_object: false  // Accept unsigned requests
        },
        callbacks: { hash: hashCallback, verifyJwt: verifyJwtCallback },
        authorizationRequestJwt: parsed.authorizationRequestJwt ? {
          jwt: parsed.authorizationRequestJwt,
          signer: clientSignerFromFederation
        } : undefined,
        request: httpRequest
      });

      RFC 9101 Section 10.5 - require_signed_request_object

    Settings

    Member Visibility