Demonstrating Proof of Possession

.gitignore

@@ -22,3 +22,4 @@ node_modules/
 .vscode/
 temp/
 .history/
+.idea/

docs/oidc-client-ts.api.md

@@ -47,6 +47,8 @@ export class CheckSessionIFrame {
 
 // @public (undocumented)
 export interface CreateSigninRequestArgs extends Omit<SigninRequestCreateArgs, "url" | "authority" | "client_id" | "redirect_uri" | "response_type" | "scope" | "state_data"> {
+    // (undocumented)
+    dpopJkt?: string;
     // (undocumented)
     redirect_uri?: string;
     // (undocumented)
@@ -139,6 +141,26 @@ export interface INavigator {
     prepare(params: unknown): Promise<IWindow>;
 }
 
+// @public (undocumented)
+export class IndexedDbCryptoKeyPairStore {
+    // (undocumented)
+    static createStore<T>(dbName: string, storeName: string): Promise<(txMode: IDBTransactionMode, callback: (store: IDBObjectStore) => T | PromiseLike<T>) => Promise<T>>;
+    // (undocumented)
+    static dbName: string;
+    // (undocumented)
+    static get(key: string): Promise<CryptoKeyPair | null>;
+    // (undocumented)
+    static getAllKeys(): Promise<string[]>;
+    // (undocumented)
+    static promisifyRequest<T = undefined>(request: IDBRequest<T> | IDBTransaction): Promise<T>;
+    // (undocumented)
+    static remove(key: string): Promise<CryptoKeyPair | null>;
+    // (undocumented)
+    static set(key: string, value: CryptoKeyPair): Promise<void>;
+    // (undocumented)
+    static storeName: string;
+}
+
 // @public (undocumented)
 export class InMemoryWebStorage implements Storage {
     // (undocumented)
@@ -301,7 +323,7 @@ export class OidcClient {
     // (undocumented)
     clearStaleState(): Promise<void>;
     // (undocumented)
-    createSigninRequest({ state, request, request_uri, request_type, id_token_hint, login_hint, skipUserInfo, nonce, url_state, response_type, scope, redirect_uri, prompt, display, max_age, ui_locales, acr_values, resource, response_mode, extraQueryParams, extraTokenParams, }: CreateSigninRequestArgs): Promise<SigninRequest>;
+    createSigninRequest({ state, request, request_uri, request_type, id_token_hint, login_hint, skipUserInfo, nonce, dpopJkt, url_state, response_type, scope, redirect_uri, prompt, display, max_age, ui_locales, acr_values, resource, response_mode, extraQueryParams, extraTokenParams, }: CreateSigninRequestArgs): Promise<SigninRequest>;
     // (undocumented)
     createSignoutRequest({ state, id_token_hint, client_id, request_type, post_logout_redirect_uri, extraQueryParams, }?: CreateSignoutRequestArgs): Promise<SignoutRequest>;
     // (undocumented)
@@ -311,7 +333,7 @@ export class OidcClient {
     // (undocumented)
     processResourceOwnerPasswordCredentials({ username, password, skipUserInfo, extraTokenParams, }: ProcessResourceOwnerPasswordCredentialsArgs): Promise<SigninResponse>;
     // (undocumented)
-    processSigninResponse(url: string): Promise<SigninResponse>;
+    processSigninResponse(url: string, extraHeaders?: Record<string, ExtraHeader>): Promise<SigninResponse>;
     // (undocumented)
     processSignoutResponse(url: string): Promise<SignoutResponse>;
     // (undocumented)
@@ -333,7 +355,7 @@ export class OidcClient {
     // (undocumented)
     protected readonly _tokenClient: TokenClient;
     // (undocumented)
-    useRefreshToken({ state, redirect_uri, resource, timeoutInSeconds, extraTokenParams, }: UseRefreshTokenArgs): Promise<SigninResponse>;
+    useRefreshToken({ state, redirect_uri, resource, timeoutInSeconds, extraHeaders, extraTokenParams, }: UseRefreshTokenArgs): Promise<SigninResponse>;
     // Warning: (ae-forgotten-export) The symbol "ResponseValidator" needs to be exported by the entry point index.d.ts
     //
     // (undocumented)
@@ -623,7 +645,7 @@ export type SigninRedirectArgs = RedirectParams & ExtraSigninRequestArgs;
 // @public (undocumented)
 export class SigninRequest {
     // (undocumented)
-    static create({ url, authority, client_id, redirect_uri, response_type, scope, state_data, response_mode, request_type, client_secret, nonce, url_state, resource, skipUserInfo, extraQueryParams, extraTokenParams, disablePKCE, ...optionalParams }: SigninRequestCreateArgs): Promise<SigninRequest>;
+    static create({ url, authority, client_id, redirect_uri, response_type, scope, state_data, response_mode, request_type, client_secret, nonce, url_state, resource, skipUserInfo, extraQueryParams, extraTokenParams, disablePKCE, dpopJkt, ...optionalParams }: SigninRequestCreateArgs): Promise<SigninRequest>;
     // (undocumented)
     readonly state: SigninState;
     // (undocumented)
@@ -645,6 +667,8 @@ export interface SigninRequestCreateArgs {
     // (undocumented)
     display?: string;
     // (undocumented)
+    dpopJkt?: string;
+    // (undocumented)
     extraQueryParams?: Record<string, string | number | boolean>;
     // (undocumented)
     extraTokenParams?: Record<string, unknown>;
@@ -902,6 +926,8 @@ export class User {
         url_state?: string;
     });
     access_token: string;
+    // (undocumented)
+    dpopProof(url: string, httpMethod?: string): Promise<string>;
     get expired(): boolean | undefined;
     expires_at?: number;
     get expires_in(): number | undefined;
@@ -924,6 +950,8 @@ export class User {
 
 // @public (undocumented)
 export interface UseRefreshTokenArgs {
+    // (undocumented)
+    extraHeaders?: Record<string, ExtraHeader>;
     // (undocumented)
     extraTokenParams?: Record<string, unknown>;
     // (undocumented)
@@ -947,6 +975,8 @@ export class UserManager {
     clearStaleState(): Promise<void>;
     // (undocumented)
     protected readonly _client: OidcClient;
+    // (undocumented)
+    protected readonly _dpopNonceStore: WebStorageStateStore | null;
     get events(): UserManagerEvents;
     // (undocumented)
     protected readonly _events: UserManagerEvents;
@@ -1048,6 +1078,8 @@ export interface UserManagerSettings extends OidcClientSettings {
     accessTokenExpiringNotificationTimeInSeconds?: number;
     automaticSilentRenew?: boolean;
     checkSessionIntervalInSeconds?: number;
+    // Warning: (ae-forgotten-export) The symbol "DPoPSettings" needs to be exported by the entry point index.d.ts
+    dpopSettings?: DPoPSettings;
     iframeNotifyParentOrigin?: string;
     iframeScriptOrigin?: string;
     includeIdTokenInSilentRenew?: boolean;
@@ -1084,6 +1116,8 @@ export class UserManagerSettingsStore extends OidcClientSettingsStore {
     // (undocumented)
     readonly checkSessionIntervalInSeconds: number;
     // (undocumented)
+    readonly dpopSettings: DPoPSettings;
+    // (undocumented)
     readonly iframeNotifyParentOrigin: string | undefined;
     // (undocumented)
     readonly iframeScriptOrigin: string | undefined;

jest-environment-jsdom.cjs

@@ -0,0 +1,28 @@
+'use strict';
+
+const { TextEncoder, TextDecoder } = require('util');
+const { default: $JSDOMEnvironment, TestEnvironment } = require('jest-environment-jsdom');
+const crypto = require("crypto");
+
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});
+
+class JSDOMEnvironment extends $JSDOMEnvironment {
+    constructor(...args) {
+        const { global } = super(...args);
+        // see https://github.com/jsdom/jsdom/issues/2524
+        global.TextEncoder = TextEncoder;
+        global.TextDecoder = TextDecoder;
+        // see https://github.com/jestjs/jest/issues/9983
+        global.Uint8Array = Uint8Array;
+        global.crypto.subtle = crypto.subtle;
+        global.crypto.randomUUID = crypto.randomUUID;
+        // see https://github.com/dumbmatter/fakeIndexedDB#jsdom-often-used-with-jest
+        global.structuredClone = structuredClone;
+    }
+}
+
+exports.default = JSDOMEnvironment;
+exports.TestEnvironment = TestEnvironment === $JSDOMEnvironment ?
+    JSDOMEnvironment : TestEnvironment;

jest.config.mjs

@@ -7,9 +7,12 @@ export default {
     clearMocks: true,
     setupFilesAfterEnv: ["./test/setup.ts"],
     testMatch: ["**/{src,test}/**/*.test.ts"],
-    testEnvironment: "jsdom",
+    testEnvironment: "./jest-environment-jsdom.cjs",
     collectCoverage,
     coverageReporters: collectCoverage ? ["lcov"] : ["lcov", "text"],
+    moduleNameMapper: {
+        "^jose": "jose",  // map to jose cjs module otherwise jest breaks
+    },
     transform: {
         "^.+\\.tsx?$": [
             "ts-jest",

package.json

@@ -39,6 +39,7 @@
     "prepare": "husky install"
   },
   "dependencies": {
+    "crypto-js": "^4.1.1",
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
@@ -51,11 +52,13 @@
     "esbuild": "^0.20.0",
     "eslint": "^8.5.0",
     "eslint-plugin-testing-library": "^6.0.0",
+    "fake-indexeddb": "^5.0.1",
     "http-proxy-middleware": "^2.0.1",
     "husky": "^9.0.6",
     "jest": "^29.3.1",
     "jest-environment-jsdom": "^29.3.1",
     "jest-mock": "^29.3.1",
+    "jose": "^5.1.2",
     "lint-staged": "^15.0.1",
     "ts-jest": "^29.0.3",
     "typedoc": "^0.25.0",

src/DPoPService.test.ts

@@ -0,0 +1,44 @@
+import { DPoPService } from "./DPoPService";
+import { jwtVerify, decodeProtectedHeader, importJWK, type JWK } from "jose";
+import { IndexedDbCryptoKeyPairStore as idb } from "./IndexedDbCryptoKeyPairStore";
+
+describe("DPoPService", () => {
+
+    beforeEach(async () => {
+        await idb.remove("oidc.dpop");
+    });
+
+    describe("generateDPoPProof", () => {
+        it("should generate a valid proof without an access token", async () => {
+            const proof = await DPoPService.generateDPoPProof({ url: "http://example.com" });
+            const protectedHeader = decodeProtectedHeader(proof);
+            const publicKey = await importJWK(<JWK>protectedHeader.jwk);
+            const verifiedResult = await jwtVerify(proof, publicKey);
+
+            expect(verifiedResult.payload).toHaveProperty("htu");
+            expect(verifiedResult.payload).toHaveProperty("htm");
+        });
+
+        it("should generate a valid proof with an access token", async () => {
+            await DPoPService.generateDPoPProof({ url: "http://example.com" });
+            const proof = await DPoPService.generateDPoPProof({ url: "http://example.com", accessToken: "some_access_token" });
+
+            const protectedHeader = decodeProtectedHeader(proof);
+            const publicKey = await importJWK(<JWK>protectedHeader.jwk);
+            const verifiedResult = await jwtVerify(proof, publicKey);
+
+            expect(verifiedResult.payload).toHaveProperty("htu");
+            expect(verifiedResult.payload).toHaveProperty("htm");
+            expect(verifiedResult.payload).toHaveProperty("ath");
+            expect(verifiedResult.payload["htu"]).toEqual("http://example.com");
+        });
+    });
+
+    describe("dpopJkt", () => {
+        it("should generate crypto keys when generating a dpop thumbprint if no keys exists in the store", async () => {
+            const setMock = jest.spyOn(idb, "set");
+            await DPoPService.generateDPoPJkt();
+            expect(setMock).toHaveBeenCalled();
+        });
+    });
+});