DpopTokenGenerator class abstract

Generates DPoP (Demonstrating Proof-of-Possession) proof tokens per RFC 9449 and the Solid-OIDC specification.

Two kinds of DPoP proof

1. Token-endpoint proof (call generateForTokenEndpoint)

Sent as the DPoP header on the token request to the OP. The OP uses it to key-bind the issued access token by embedding cnf: { jkt: "<thumbprint>" } in the token payload.

POST /token
DPoP: <proof>            ← no `ath` claim here
Content-Type: application/x-www-form-urlencoded
...

2. Resource-server proof (call generateForRequest)

Sent alongside every protected-resource HTTP request. The RS checks:

  • htm matches the HTTP method.
  • htu matches the request URL.
  • jti has not been seen before (replay prevention).
  • The proof is signed by the key whose thumbprint matches cnf.jkt in the access token.
  • ath = base64url(SHA-256(ASCII(access_token))).
PATCH /resource
Authorization: DPoP <access_token>
DPoP: <proof>            ← includes `ath` claim

The cnf error your Solid server returned means the access token was issued WITHOUT step 1 — there was no DPoP proof on the token request.

Properties

hashCode → int
The hash code for this object.
no setterinherited
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Static Methods

generate({required String endpointUrl, required KeyPair keyPair, required Map<String, dynamic> publicKeyJwk, required String httpMethod, String? accessToken}) → String
Generates a DPoP proof JWT.
generateForRequest({required String endpointUrl, required String httpMethod, String? accessToken, DpopKeyManager? keyManager}) → Future<String>
Generates a DPoP proof for httpMethod on endpointUrl, automatically using the managed key pair from DpopKeyManager.
generateForTokenEndpoint({required String tokenEndpointUrl, DpopKeyManager? keyManager}) → Future<String>
Generates a DPoP proof for the token endpoint request.