Class: DPoPKey

DPoPKey(alg, privateKey, publicJwk, thumbprint)

A DPoP key pair (RFC 9449) and the proofs made with it.

The private key is generated NON-EXTRACTABLE: script running in the page (including injected script) can ask it to sign while the page is open, but can never read it out, so a stolen access or refresh token is useless anywhere else. Keep the same key for the lifetime of the tokens it binds. IndexedDBKeyStore keeps that non-extractable key across page loads. WebStorageKeyStore keeps an extractable copy in sessionStorage for this tab, which is what Web Storage can hold.

Constructor

new DPoPKey(alg, privateKey, publicJwk, thumbprint)

Use DPoPKey.create() or DPoPKey.loadOrCreate() rather than this.

Parameters:
Name Type Description
alg string
privateKey CryptoKey
publicJwk Record.<string, string>
thumbprint string
Source:

Classes

DPoPKey

Members

alg :string

Type:
  • string
Source:

publicJwk :Record.<string, any>

Type:
  • Record.<string, any>
Source:

thumbprint

RFC 7638 SHA-256 thumbprint of the public key (the jkt). @type {string}

Source:

Methods

(async) proof(opts)

Creates a DPoP proof JWT (RFC 9449 ยง4.2).

Parameters:
Name Type Description
opts Object

(TypeScript: { method: string, url: string, nonce?: string, accessToken?: string })
Source:

(async, static) create(optsopt)

Builds a key from a CryptoKeyPair, generating a new pair if none is given. Generated keys are non-extractable unless extractable is set, which sessionStorage requires.

Parameters:
Name Type Attributes Description
opts Object <optional>

(TypeScript: { alg?: string, keyPair?: CryptoKeyPair, extractable?: boolean })
Source:

(async, static) loadOrCreate(store, optsopt)

Loads the key held in store, or creates one and stores it.

Parameters:
Name Type Attributes Description
store Object
opts Object <optional>

(TypeScript: { alg?: string })
Source: