Sender-Constrained Tokens with DPoP

// extractable: false is the entire security benefit in a browser. The key can
// be USED by anything on the page, but never read out and carried away.
async function createDpopKey() {
  const pair = await crypto.subtle.generateKey(
    { name: 'ECDSA', namedCurve: 'P-256' },
    false,                                   // ← non-extractable
    ['sign', 'verify'],
  );
  // Persist the CryptoKey handle itself; IndexedDB can store it without the
  // raw material ever being exposed to JavaScript.
  await idbPut('dpop', 'key', pair);
  return pair;
}

const b64url = (buf) =>
  btoa(String.fromCharCode(...new Uint8Array(buf)))
    .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');

async function dpopProof({ method, url, accessToken, nonce }) {
  const pair = await idbGet('dpop', 'key');
  const jwk = await crypto.subtle.exportKey('jwk', pair.publicKey);  // public only

  const header = {
    typ: 'dpop+jwt',
    alg: 'ES256',
    jwk: { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y },   // no 'd' — private
  };

  const payload = {
    htm: method.toUpperCase(),
    htu: url.split('?')[0].split('#')[0],       // no query, no fragment
    iat: Math.floor(Date.now() / 1000),
    jti: crypto.randomUUID(),
    ...(nonce ? { nonce } : {}),
    // ath binds the proof to THIS access token — required at resource servers
    ...(accessToken
      ? { ath: b64url(await crypto.subtle.digest('SHA-256',
            new TextEncoder().encode(accessToken))) }
      : {}),
  };

  const signingInput =
    `${b64url(new TextEncoder().encode(JSON.stringify(header)))}.` +
    `${b64url(new TextEncoder().encode(JSON.stringify(payload)))}`;

  const sig = await crypto.subtle.sign(
    { name: 'ECDSA', hash: 'SHA-256' },
    pair.privateKey,
    new TextEncoder().encode(signingInput),
  );

  return `${signingInput}.${b64url(sig)}`;
}

let dpopNonce = null;      // servers rotate this; keep the latest

export async function dpopFetch(url, options = {}) {
  const method = (options.method ?? 'GET').toUpperCase();
  const token = await getAccessToken();

  const send = async () => fetch(url, {
    ...options,
    headers: {
      ...options.headers,
      Authorization: `DPoP ${token}`,          // NOT 'Bearer'
      DPoP: await dpopProof({ method, url, accessToken: token, nonce: dpopNonce }),
    },
  });

  let res = await send();

  // The server may demand a nonce it chooses. Retry ONCE with it.
  if (res.status === 401) {
    const supplied = res.headers.get('DPoP-Nonce');
    const wwwAuth = res.headers.get('WWW-Authenticate') ?? '';
    if (supplied && wwwAuth.includes('use_dpop_nonce')) {
      dpopNonce = supplied;
      res = await send();                      // fresh proof, fresh jti
    }
  }

  // Servers rotate the nonce proactively — always take the newest one.
  const rotated = res.headers.get('DPoP-Nonce');
  if (rotated) dpopNonce = rotated;

  return res;
}

// Missing this retry is the classic first-implementation bug: everything works
// against a server that does not require nonces, then breaks in production.

import { jwtVerify, calculateJwkThumbprint, importJWK, decodeProtectedHeader } from 'jose';
import { createHash } from 'crypto';

const PROOF_MAX_AGE_S = 60;

export async function verifyDpop(req, accessTokenClaims, rawAccessToken) {
  const proof = req.get('dpop');
  if (!proof) throw new AuthError('use_dpop_nonce', 'DPoP proof required');

  // 1. The header must declare the right type and carry the public key.
  const header = decodeProtectedHeader(proof);
  if (header.typ !== 'dpop+jwt') throw new AuthError('invalid_dpop_proof', 'bad typ');
  if (!header.jwk || header.jwk.d) throw new AuthError('invalid_dpop_proof', 'bad jwk');
  if (!['ES256', 'RS256', 'PS256'].includes(header.alg)) {
    throw new AuthError('invalid_dpop_proof', 'unsupported alg');
  }

  // 2. The proof must verify against the key it embeds.
  const key = await importJWK(header.jwk, header.alg);
  const { payload } = await jwtVerify(proof, key, { clockTolerance: 5 });

  // 3. Method and URL must match THIS request.
  const expectedUrl = `${req.protocol}://${req.get('host')}${req.path}`;
  if (payload.htm !== req.method) throw new AuthError('invalid_dpop_proof', 'htm mismatch');
  if (payload.htu !== expectedUrl) throw new AuthError('invalid_dpop_proof', 'htu mismatch');

  // 4. Freshness.
  const age = Math.floor(Date.now() / 1000) - Number(payload.iat ?? 0);
  if (!payload.iat || age > PROOF_MAX_AGE_S || age < -5) {
    throw new AuthError('invalid_dpop_proof', 'stale proof');
  }

  // 5. Replay: jti must be unseen. TTL matches the acceptance window.
  if (!payload.jti) throw new AuthError('invalid_dpop_proof', 'missing jti');
  const fresh = await redis.set(`dpop:${payload.jti}`, '1', 'EX', PROOF_MAX_AGE_S, 'NX');
  if (!fresh) throw new AuthError('invalid_dpop_proof', 'proof replayed');

  // 6. ath binds the proof to this specific access token.
  const ath = createHash('sha256').update(rawAccessToken).digest('base64url');
  if (payload.ath !== ath) throw new AuthError('invalid_dpop_proof', 'ath mismatch');

  // 7. THE BINDING: the token's cnf.jkt must equal this key's thumbprint.
  const thumbprint = await calculateJwkThumbprint(header.jwk, 'sha256');
  if (accessTokenClaims.cnf?.jkt !== thumbprint) {
    throw new AuthError('invalid_token', 'token is not bound to this key');
  }

  // 8. Nonce, if this server requires one.
  if (REQUIRE_NONCE && !(await nonceIsValid(payload.nonce))) {
    throw new AuthError('use_dpop_nonce', 'nonce required', { nonce: issueNonce() });
  }

  return true;
}

// Step 7 is the one that matters. Skip it and you have an elaborate ritual that
// verifies a proof against a key the attacker also chose — no binding at all.