dpop

import * as DPoP from 'dpop'; async function runDPoPExample() { console.log('Starting DPoP example...'); // 1. Generate a DPoP Key Pair (e.g., ES256 algorithm) // The 'extractable: false' option is good practice for non-exportable keys const keyPair = await DPoP.generateKeyPair('ES256', { extractable: false }); console.log('DPoP Key Pair generated using ES256.'); // 2. Calculate the dpop_jkt (Key Thumbprint) for authorization code binding // This identifies the public key associated with the DPoP proof const dpop_jkt = await DPoP.calculateThumbprint(keyPair.publicKey); console.log('Calculated dpop_jkt:', dpop_jkt); // 3. Generate a DPoP proof for an Authorization Server (AS) token request // This proof is sent with the token request to the AS const asTokenUrl = 'https://as.example.com/token'; const asProof = await DPoP.generateProof(keyPair, asTokenUrl, 'POST'); console.log('DPoP Proof for AS Token Request:', asProof.slice(0, 100), '...'); // Truncate for display // 4. Simulate an Access Token from the AS and generate a DPoP proof for a Resource Server (RS) API request // The access token is bound to the DPoP key when making requests to the RS const rsApiUrl = 'https://rs.example.com/api/data'; const accessToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJhY2Nlc3NfdG9rZW4iOnRydWV9.SflKxwRJSMeKKF2F8DGD_dPOk_W5dZg_qkX-zHjN_W0'; // Example dummy token const nonceFromRS = undefined; // In a real scenario, this might come from a 'DPoP-Nonce' header const rsProof = await DPoP.generateProof( keyPair, rsApiUrl, 'GET', nonceFromRS, accessToken ); console.log('DPoP Proof for RS API Request:', rsProof.slice(0, 100), '...'); // Truncate for display } runDPoPExample().catch(console.error);