feat: explicitly add dpop_jkt to par request when using dpop

panva · May 5, 2022 · e6acd99 · e6acd99
1 parent f7c1f38
commit e6acd99
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/src/index.ts b/src/index.ts
@@ -1388,6 +1388,7 @@ export async function pushedAuthorizationRequest(
 
   if (options?.DPoP !== undefined) {
     await dpopProofJwt(headers, options.DPoP, url, 'POST')
+    body.set('dpop_jkt', await calculateJwkThumbprint(options?.DPoP.publicKey))
   }
 
   return authenticatedRequest(as, client, 'POST', url, body, headers, options)

diff --git a/test/par.test.ts b/test/par.test.ts
@@ -93,7 +93,7 @@ test('pushedAuthorizationRequest() w/ DPoP', async (t) => {
         dpop: /.+/,
       },
       body(body) {
-        return new URLSearchParams(body).get('client_id') === client.client_id
+        return new URLSearchParams(body).has('dpop_jkt')
       },
     })
     .reply(200, { request_uri: 'urn:example:uri', expires_in: 60 })