oidcCreateRequestObject function

String oidcCreateRequestObject({ required Map<String, dynamic> parameters, required JsonWebKey key, required String algorithm, required String issuer, required String audience, Duration lifetime = const Duration(minutes: 5), Duration clockSkew = Duration.zero, Random? random, })

Builds a signed JWT-Secured Authorization Request object (RFC 9101 §4) from the authorization parameters.

The returned compact JWS is the value of the request authorization parameter. iss is set to the client_id and aud to the authorization server (its issuer), per RFC 9101 §6.1; iat/exp/jti are added. The typ header is oauth-authz-req+jwt (RFC 9101 §10.8).

Implementation

String oidcCreateRequestObject({
  required Map<String, dynamic> parameters,
  required JsonWebKey key,
  required String algorithm,
  required String issuer,
  required String audience,
  Duration lifetime = const Duration(minutes: 5),
  Duration clockSkew = Duration.zero,
  Random? random,
}) {
  final now = clock.now();
  final claims = <String, dynamic>{
    ...parameters,
    'iss': issuer,
    'aud': audience,
    'jti': oidcGenerateRequestObjectJti(random),
    'iat': now.subtract(clockSkew).millisecondsSinceEpoch ~/ 1000,
    'nbf': now.subtract(clockSkew).millisecondsSinceEpoch ~/ 1000,
    'exp': now.add(lifetime).millisecondsSinceEpoch ~/ 1000,
  };
  return (JsonWebSignatureBuilder()
        ..jsonContent = claims
        ..setProtectedHeader('typ', 'oauth-authz-req+jwt')
        ..addRecipient(key, algorithm: algorithm))
      .build()
      .toCompactSerialization();
}