GetPublicKey returns the public key from the DPoP proof's JWK.

GetPublicKey returns the public key from the DPoP proof's JWK. This method implements the core.DPoPProofClaims interface.

GetPublicKeyThumbprint returns the calculated JKT from the DPoP proof's JWK.

GetPublicKeyThumbprint returns the calculated JKT from the DPoP proof's JWK. This method implements the core.DPoPProofClaims interface.

HasConfirmation returns true if the token has a cnf claim.

Is allows the error to be compared with ErrJWTInvalid.

NewRedisCache creates a new Redis-backed cache for JWKS.

Unwrap allows the error to support equality to the underlying error and not just ErrJWTInvalid.

Unwrap returns the underlying error for error unwrapping.

WithStrictJWKSURIOrigin enables strict validation that the jwks_uri returned by OIDC discovery shares the same scheme and host as the issuer URL. Thi

applyDefaults sets secure default values for optional fields

applyDefaults sets secure default values for optional fields.

backgroundRefresh refreshes JWKS in the background without blocking requests. This prevents cache expiry from blocking requests by proactively refresh

checkJWT is an iris.Handler middleware that will check the validity of our JWT.

checkJWT is a gin.HandlerFunc middleware that will check the validity of our JWT.

computeATH computes the ATH (Access Token Hash) claim for DPoP proofs

computeATH computes the ATH (Access Token Hash) claim for DPoP proofs

createCore creates the core.Core instance with the configured options

createCore creates the core.Core instance with the configured options.

discoverJWKSURI discovers the JWKS URI from the well-known endpoint. Uses mutex + discovered flag so that transient failures (network blips, IdP 503s)

extractAndValidateClaims extracts claims from the token and validates them. Optimized to minimize method calls and allocations. Note: Issuer is valida

generateTestTokenWithKid creates a test JWT token with a specific kid in the header. Used for testing jwk.Set key matching with multi-algorithm config

generateTestTokenWithoutIssuer creates a test JWT token without an issuer claim. Used for testing issuer validation failures.

generateToken creates a test JWT token

getJWKSURI returns the JWKS URI, discovering it if necessary.

getOrCreateProvider retrieves an existing provider for the issuer or creates a new one. Uses double-checked locking for optimal performance and thread

getTenantIssuersFromDB simulates a database query In production, replace this with actual database call

logInfo logs an info message if the logger is configured.

mapErrorToResponse maps errors to appropriate HTTP responses with WWW-Authenticate headers. In DPoP allowed mode, returns both Bearer and DPoP challen

mapValidationError maps core.ValidationError codes to HTTP responses with appropriate WWW-Authenticate headers.

mapValidationError maps core.ValidationError to gRPC status codes. This function relies on error codes from core package for reliable error classifica

sameOrigin compares two URLs for same-origin equality following RFC 3986: - Schemes are compared case-insensitively (Section 3.1) - Hosts are compared

shouldSkipValidation checks if JWT validation should be skipped for this request.

tenantMiddleware extracts tenant ID from request headers In production, this might extract from subdomain, path, or custom header

validate ensures all required fields are set

validate ensures all required fields are set.

validate ensures all required fields are set.

validateATH validates the ATH (Access Token Hash) claim. Per RFC 9449 Section 4.2, the ath claim is REQUIRED for sender-constraining security. Without

validateDPoPProofJWT validates the DPoP proof JWT and returns the claims.

validateDPoPToken validates a DPoP token with proof.

validateHTMAndHTU validates the HTM (HTTP method) and HTU (HTTP URI) claims.

validateIATFreshness validates that the DPoP proof IAT is within acceptable bounds.

validateJKTBinding verifies that the DPoP proof JKT matches the token's cnf.jkt claim.

validateToken performs JWT validation with or without DPoP support.

Deprecated: Use HelloRequest.ProtoReflect.Descriptor instead.

Deprecated: Use HelloReply.ProtoReflect.Descriptor instead.

Deprecated: Use HealthCheckRequest.ProtoReflect.Descriptor instead.

Deprecated: Use HealthCheckReply.ProtoReflect.Descriptor instead.

Get retrieves JWKS from Redis or fetches it if not cached.

GetATH returns the access token hash (ath) from the DPoP proof. This is an optional claim that binds the proof to a specific access token. This method

GetClaims retrieves claims from the context with type safety using generics. This provides compile-time type checking and eliminates the need for manu

GetClaims retrieves claims from the context with type safety using generics. This is a type-safe alternative to manually type-asserting the claims fr

GetClaims retrieves claims from the context with type safety using generics. This is a type-safe alternative to manually type-asserting the claims fr

GetJTI returns the unique identifier (jti) of the DPoP proof.

Health check (no authentication required)

HealthCheck returns server status. No authentication required.