fix(DPoP): compare htu scheme and hostname case independent

panva · Aug 30, 2023 · b72d668 · b72d668
1 parent 2176909
commit b72d668
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/helpers/validate_dpop.js b/lib/helpers/validate_dpop.js
@@ -71,7 +71,7 @@ export default async (ctx, accessToken) => {
     }
 
     {
-      const expected = ctx.oidc.urlFor(ctx.oidc.route);
+      const expected = new URL(ctx.oidc.urlFor(ctx.oidc.route)).href;
       let actual;
       try {
         actual = new URL(payload.htu);