DPoPNonceOptions Class
Abblix.Oidc.Server
Abblix.Oidc.Server.Common.Configuration
DPoPNonceOptions Class
DPoP-specific extension of NonceOptions per RFC 9449 §8.
Inherits the generic primitive's AcceptanceWindow and
RotationInterval so DPoP can override them independently of any
other nonce-service consumer, and adds the per-endpoint policy that says
which OAuth endpoints reject DPoP proofs without a nonce claim
(responding with use_dpop_nonce and a fresh DPoP-Nonce
header).
public class DPoPNonceOptions : Abblix.Oidc.Server.Features.Nonces.NonceOptions
Inheritance System.Object → NonceOptions → DPoPNonceOptions
Remarks
Per-endpoint flags exist only for endpoints where RFC 9449 specifies DPoP applicability: the token endpoint (§5) and protected resources / UserInfo (§7). RFC 9449 §6.2 explicitly disclaims DPoP at the introspection endpoint and stays silent on the revocation endpoint, so flags for those endpoints would be misleading non-spec promises and are intentionally absent.
DPoP is the only nonce-service consumer at present, so the active
RollingHmacNonceService binds directly against this type via
DPoP.Nonce; the
inherited AcceptanceWindow and
RotationInterval drive issuance. When a
second consumer (e.g. state-parameter validation) arrives, it brings
its own NonceOptions-derived options class and its own
service registration; the inheritance hierarchy is what lets each
consumer diverge on window and rotation independently.
Properties
DPoPNonceOptions.RequireAtTokenEndpoint Property
When true, the token endpoint rejects DPoP requests that omit a
nonce claim with use_dpop_nonce per RFC 9449 §8. Defaults to
false; raise to true to opt the deployment into
nonce-protected token issuance.
public bool RequireAtTokenEndpoint { get; set; }
Property Value
DPoPNonceOptions.RequireAtUserInfoEndpoint Property
Same as RequireAtTokenEndpoint but for the UserInfo
endpoint per RFC 9449 §7. Defaults to false.
public bool RequireAtUserInfoEndpoint { get; set; }