Class DPoPProofReplayValidator

java.lang.Object

org.springframework.security.oauth2.jwt.DPoPProofReplayValidator

All Implemented Interfaces:

org.springframework.security.oauth2.core.OAuth2TokenValidator<Jwt>

public final class DPoPProofReplayValidator
extends Object
implements org.springframework.security.oauth2.core.OAuth2TokenValidator<Jwt>

An OAuth2TokenValidator that mitigates DPoP Proof Replay.

This validator mitigates DPoP Proof Replay by ensuring the DPoP Proof:

• contains the iat (issued at) claim, and it's within an acceptable time window (configured via setClockSkew(Duration))
• contains the jti (JWT ID) claim, and it has not been used previously

This implementation uses a Cache to store the jti claim (along with other information in CacheValue) to enforce single-use. The jti is retained in the cache until the DPoP Proof expires, which is calculated as iat + clockSkew.

Since:

6.5.12

See Also:

• OAuth2TokenValidator
• DPoPProofJwtDecoderFactory
• Section 11.1. DPoP Proof Replay

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	DPoPProofReplayValidator.CacheValue	A representation of the value to which the Cache maps a (hashed) (jti) claim as the key.
static final class	DPoPProofReplayValidator.InMemoryCache	An in-memory Cache implementation backed by a ConcurrentHashMap.

Constructor Summary

Constructors

Constructor	Description
DPoPProofReplayValidator(org.springframework.cache.Cache cache)	Constructs a DPoPProofReplayValidator using the provided parameters.

Method Summary

Modifier and Type	Method	Description
void	setClock(Clock clock)	Sets the Clock used in Instant.now(Clock).
void	setClockSkew(Duration clockSkew)	Sets the clock skew.
org.springframework.security.oauth2.core.OAuth2TokenValidatorResult	validate(Jwt jwt)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DPoPProofReplayValidator

public DPoPProofReplayValidator(org.springframework.cache.Cache cache)

Constructs a DPoPProofReplayValidator using the provided parameters.

Parameters:

cache - the Cache used to store DPoPProofReplayValidator.CacheValue which contains information of the used DPoP Proof Jwt's

Method Details

validate

public org.springframework.security.oauth2.core.OAuth2TokenValidatorResult validate(Jwt jwt)

Specified by:

validate in interface org.springframework.security.oauth2.core.OAuth2TokenValidator<Jwt>

setClockSkew

public void setClockSkew(Duration clockSkew)

Sets the clock skew. The default is 30 seconds.

Parameters:

clockSkew - the clock skew

setClock

public void setClock(Clock clock)

Sets the Clock used in Instant.now(Clock).

Parameters:

clock - the clock