Class DPoPProofReplayValidator

java.lang.Object

org.springframework.security.oauth2.jwt.DPoPProofReplayValidator

All Implemented Interfaces:

OAuth2TokenValidator<Jwt>

public final class DPoPProofReplayValidator
extends Object
implements OAuth2TokenValidator<Jwt>

An OAuth2TokenValidator that mitigates DPoP Proof Replay.

This validator mitigates DPoP Proof Replay by ensuring the DPoP Proof:

• contains the iat (issued at) claim, and it's within an acceptable time window (configured via setClockSkew(Duration))
• contains the jti (JWT ID) claim, and it has not been used previously

This implementation uses a Cache to store the jti claim (along with other information in CacheValue) to enforce single-use. The jti is retained in the cache until the DPoP Proof expires, which is calculated as iat + clockSkew.

Since:

6.5.12

See Also:

• OAuth2TokenValidator
• DPoPProofJwtDecoderFactory
• Section 11.1. DPoP Proof Replay

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	DPoPProofReplayValidator.CacheValue	A representation of the value to which the Cache maps a (hashed) (jti) claim as the key.
static final class	DPoPProofReplayValidator.InMemoryCache	An in-memory Cache implementation backed by a ConcurrentHashMap.

Constructor Summary

Constructors

Constructor	Description
DPoPProofReplayValidator(org.springframework.cache.Cache cache)	Constructs a DPoPProofReplayValidator using the provided parameters.

Method Summary

Modifier and Type	Method	Description
void	setClock(Clock clock)	Sets the Clock used in Instant.now(Clock).
void	setClockSkew(Duration clockSkew)	Sets the clock skew.
OAuth2TokenValidatorResult	validate(Jwt jwt)	Verify the validity and/or constraints of the provided OAuth 2.0 Token.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DPoPProofReplayValidator

public DPoPProofReplayValidator(org.springframework.cache.Cache cache)

Constructs a DPoPProofReplayValidator using the provided parameters.

Parameters:

cache - the Cache used to store DPoPProofReplayValidator.CacheValue which contains information of the used DPoP Proof Jwt's

Method Details

validate

public OAuth2TokenValidatorResult validate(Jwt jwt)

Description copied from interface: OAuth2TokenValidator

Verify the validity and/or constraints of the provided OAuth 2.0 Token.

Specified by:

validate in interface OAuth2TokenValidator<Jwt>

Parameters:

jwt - an OAuth 2.0 token

Returns:

OAuth2TokenValidationResult the success or failure detail of the validation

setClockSkew

public void setClockSkew(Duration clockSkew)

Sets the clock skew. The default is 30 seconds.

Parameters:

clockSkew - the clock skew

setClock

public void setClock(Clock clock)

Sets the Clock used in Instant.now(Clock).

Parameters:

clock - the clock