IO Wallet SDK
    Preparing search index...

    Function verifyTokenDPoP

    • Verifies a DPoP proof JWT against an HTTP request and optional token binding data.

      Parameters

      • options: VerifyTokenDPoPOptions

        DPoP verification options.

        • OptionalaccessToken?: string

          Access token to which the dpop jwt is bound. If provided the sha-256 hash of the access token needs to match the 'ath' claim.

        • OptionalallowedSigningAlgs?: string[]

          Allowed dpop signing alg values. If not provided any alg values are allowed and it's up to the verifyJwtCallback to handle the alg.

        • callbacks: Pick<CallbackContext, "hash" | "verifyJwt">

          Callbacks used for verifying dpop jwt

        • dpopJwt: string

          The compact dpop jwt.

        • OptionalexpectedJwkThumbprint?: string

          The expected jwk thumprint 'jti' confirmation method. If provided the thumprint of the jwk used to sign the dpop jwt must match this provided thumbprint value. The 'jti' value can be extracted from the access token payload, or if opaque tokens are used can be retrieved using token introspection.

        • OptionalexpectedNonce?: string

          Expected nonce in the payload. If not provided the nonce won't be validated.

        • Optionalnow?: Date

          The current time to use when verifying the JWTs. If not provided current time will be used.

          new Date()
        • request: RequestLike

          The request for which to verify the dpop jwt

      Returns Promise<
          {
              header: {
                  alg: string;
                  jwk: {
                      alg?: string;
                      crv?: string;
                      d?: string;
                      dp?: string;
                      dq?: string;
                      e?: string;
                      ext?: boolean;
                      k?: string;
                      key_ops?: string[];
                      kid?: string;
                      kty: string;
                      n?: string;
                      oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
                      p?: string;
                      q?: string;
                      qi?: string;
                      use?: string;
                      x?: string;
                      x5c?: string[];
                      x5t?: string;
                      "x5t#S256"?: string;
                      x5u?: string;
                      y?: string;
                      [key: string]: unknown;
                  };
                  kid?: string;
                  trust_chain?: [string, ...string[]];
                  typ: "dpop+jwt";
                  x5c?: string[];
                  [key: string]: unknown;
              };
              jwkThumbprint: string;
              payload: {
                  ath?: string;
                  aud?: string;
                  cnf?: {
                      jkt?: string;
                      jwk?: {
                          alg?: string;
                          crv?: string;
                          d?: string;
                          dp?: string;
                          dq?: string;
                          e?: string;
                          ext?: boolean;
                          k?: string;
                          key_ops?: string[];
                          kid?: string;
                          kty: string;
                          n?: string;
                          oth?: {
                              d?: (...)
                              | (...);
                              r?: (...) | (...);
                              t?: (...) | (...);
                              [key: string]: unknown;
                          }[];
                          p?: string;
                          q?: string;
                          qi?: string;
                          use?: string;
                          x?: string;
                          x5c?: string[];
                          x5t?: string;
                          "x5t#S256"?: string;
                          x5u?: string;
                          y?: string;
                          [key: string]: unknown;
                      };
                      [key: string]: unknown;
                  };
                  exp?: number;
                  htm: | "GET"
                  | "POST"
                  | "PUT"
                  | "DELETE"
                  | "HEAD"
                  | "OPTIONS"
                  | "TRACE"
                  | "CONNECT"
                  | "PATCH";
                  htu: string;
                  iat: number;
                  iss?: string;
                  jti: string;
                  nbf?: number;
                  nonce?: string;
                  status?: Record<string, any>;
                  trust_chain?: [string, ...string[]];
                  [key: string]: unknown;
              };
          },
      >

      Decoded JWT header, payload, and resolved signer.

      If any DPoP claim, token binding, or signature validation fails.

    Settings

    Member Visibility