oidc-caep-client
    Preparing search index...

    Interface SSFReceiverConfig

    interface SSFReceiverConfig {
        accessToken?: () => string | Promise<string>;
        allowInsecureRequests?: boolean;
        audience?: string | string[];
        authorizationHeaders?: (
            req: { method: string; nonce?: string; url: string },
        ) => Promise<Record<string, string>>;
        clockToleranceSec?: number;
        deleteOnPageHide?: boolean;
        description?: string;
        eventsRequested?: string[];
        fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
        handlers?: Partial<
            Record<
                | "sessionRevoked"
                | "tokenClaimsChange"
                | "credentialChange"
                | "assuranceLevelChange"
                | "deviceComplianceChange"
                | "sessionEstablished"
                | "sessionPresented"
                | "riskLevelChange"
                | "verification"
                | "streamUpdated",
                SecurityEventHandler,
            >,
        >;
        httpTimeoutMs?: number;
        jtiCacheSize?: number;
        maxDeliveryAttempts?: number;
        maxEvents?: number;
        maxSetAgeSec?: number;
        onEventReceived?: SecurityEventHandler
        | null;
        pageEvents?: { addEventListener: Function; removeEventListener: Function };
        pollIntervalMs?: number;
        requireTyp?: boolean;
        streamId?: string;
        transmitterIssuer: string;
        trustedPollOrigins?: string[];
    }
    Index
    accessToken? allowInsecureRequests? audience? authorizationHeaders? clockToleranceSec? deleteOnPageHide? description? eventsRequested? fetch? handlers? httpTimeoutMs? jtiCacheSize? maxDeliveryAttempts? maxEvents? maxSetAgeSec? onEventReceived? pageEvents? pollIntervalMs? requireTyp? streamId? transmitterIssuer trustedPollOrigins?
    accessToken?: () => string | Promise<string>

    Bearer token for the transmitter's management and poll endpoints.

    allowInsecureRequests?: boolean

    Allow non-TLS SSF URLs other than loopback. Default false.

    audience?: string | string[]

    Expected SET aud. Defaults to the aud in the stream configuration.

    authorizationHeaders?: (
        req: { method: string; nonce?: string; url: string },
    ) => Promise<Record<string, string>>

    Alternative to accessToken: returns the Authorization (and DPoP) headers for one request, e.g. (r) => oidcClient.resourceHeaders(tokenSet, r) for a DPoP-bound token.

    clockToleranceSec?: number

    Default 60.

    deleteOnPageHide?: boolean

    Delete the stream, best effort, when the page is unloaded for good (pagehide that is not entering the back/forward cache). Default false: a stream kept across visits holds the events that arrive while no tab is open, which start({ catchUp: true }) delivers, and a browser may drop a request sent while a page unloads. Leave it off and let the transmitter time an abandoned stream out (iya-sts: ssf.personStreamInactivityTimeoutS).

    description?: string
    eventsRequested?: string[]

    Default: all CAEP event types.

    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>

    Type Declaration

      • (input: RequestInfo | URL, init?: RequestInit): Promise<Response>

      • MDN Reference

        Parameters

        • input: RequestInfo | URL
        • Optionalinit: RequestInit

        Returns Promise<Response>

    handlers?: Partial<
        Record<
            | "sessionRevoked"
            | "tokenClaimsChange"
            | "credentialChange"
            | "assuranceLevelChange"
            | "deviceComplianceChange"
            | "sessionEstablished"
            | "sessionPresented"
            | "riskLevelChange"
            | "verification"
            | "streamUpdated",
            SecurityEventHandler,
        >,
    >
    httpTimeoutMs?: number
    jtiCacheSize?: number

    Replay-protection window size. Default 10000.

    maxDeliveryAttempts?: number

    How many times a SET whose handlers throw is left for the transmitter to send again before it is acknowledged anyway (onError gets handler_failed). Default 5. A SET that can't be checked for a reason that may pass (a network error, a signing key not yet in the JWKS) is never reported as an error: it is left for redelivery until it can.

    maxEvents?: number

    Max SETs per poll. Default 25.

    maxSetAgeSec?: number

    Reject SETs whose iat is older than this (seconds). Default 0: no limit. A polled SET waits at the transmitter until it is read, so an age limit would throw away the signals a stopped receiver catches up on. A replay is caught by its jti whatever its age.

    onEventReceived?: SecurityEventHandler | null

    Your logic for every accepted event: called once per event, before the typed handlers, and awaited. Default logEventReceived, which prints the event to the console. null turns it off. A throw goes to onError with phase: 'hook', and the typed handlers still run.

    pageEvents?: { addEventListener: Function; removeEventListener: Function }

    Where pagehide is listened for. Default globalThis (the window).

    pollIntervalMs?: number

    Default 5000.

    requireTyp?: boolean

    Require the typ: secevent+jwt header (SSF §4.1.9). Default true.

    streamId?: string

    Use an existing stream instead of creating one.

    transmitterIssuer: string

    SSF transmitter issuer; metadata is loaded from its /.well-known/ssf-configuration. Delivery is RFC 8936 POLL: a browser cannot receive a push. (SETs obtained any other way can still be handed to receiveSet().)

    trustedPollOrigins?: string[]

    Origins besides the transmitter's issuer and configuration_endpoint that the stream's poll endpoint_url may be at. The poll request carries the person's access token, so it is refused anywhere else.

    Settings
    Member Visibility

    On This Page
    Properties