Abblix.Oidc.Server.Features.Nonces Namespace
Abblix.Oidc.Server
Abblix.Oidc.Server.Features.Nonces Namespace
| Classes | |
|---|---|
| NonceOptions | Base configuration class for the generic stateless-nonce service. Each feature that needs server-issued, time-bounded opaque tokens (DPoP-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state-parameter validation and challenge-response patterns) defines its own subclass — see DPoPNonceOptions — and adds its own slot under OidcOptions. This base governs only the primitive's own concerns: issuance window and secret-rotation cadence. Feature-specific policy (e.g. which DPoP endpoints require a nonce) lives on the corresponding subclass. |
| RollingHmacNonceService | HMAC-SHA256 backed implementation of INonceService. Issues stateless nonces of the form `Base64Url(timestamp_8B |
| Interfaces | |
|---|---|
| INonceService | Issues and validates server-issued opaque, time-bounded nonces. The current consumer is DPoP-Nonce per RFC 9449 §8 / §9 — the server returns a nonce via the DPoP-Nonce response header and the client echoes it back in the nonce claim of a subsequent DPoP proof to prove freshness — but the primitive is intentionally generic: any future feature needing challenge-response freshness checks can resolve the same service. |
| Enums | |
|---|---|
| NonceValidationFailure | Reasons a server-issued nonce can fail validation. The categories are for log filters and metrics — at the protocol layer DPoP-Nonce flows surface every failure as the same RFC 9449 §8 use_dpop_nonce error with a freshly issued nonce in the response header, regardless of the underlying reason. |