@axa-fr/oidc-client 7.18.5 → 7.19.1-alpha.1370

package/README.md

@@ -94,10 +94,32 @@ const trustedDomains = {
 trustedDomains.config_show_access_token = {
   oidcDomains :["https://demo.duendesoftware.com"],
   accessTokenDomains : ["https://www.myapi.com/users"],
-  showAccessToken: true,
+  showAccessToken: false,
   // convertAllRequestsToCorsExceptNavigate: false, // default value is false
   // setAccessTokenToNavigateRequests: true, // default value is true
 };
+
+// DPoP (Demonstrating Proof of Possession) will be activated for the following domains
+trustedDomains.config_with_dpop = { 
+     domains: ["https://demo.duendesoftware.com"], 
+     demonstratingProofOfPossession: true
+     // Optional, more details bellow
+     /*demonstratingProofOfPossessionConfiguration: {  
+      importKeyAlgorithm: {
+        name: 'ECDSA',
+        namedCurve: 'P-256',
+        hash: {name: 'ES256'}
+      },
+      signAlgorithm: {name: 'ECDSA', hash: {name: 'SHA-256'}},
+      generateKeyAlgorithm: {
+        name: 'ECDSA',
+        namedCurve: 'P-256'
+      },
+      digestAlgorithm: { name: 'SHA-256' },
+      jwtHeaderAlgorithm : 'ES256'
+    }*/
+};
+
 ```
 
 The code of the demo :
@@ -113,7 +135,7 @@ export const configuration = {
   authority: 'https://demo.duendesoftware.com',
   service_worker_relative_url: '/OidcServiceWorker.js', // just comment that line to disable service worker mode
   service_worker_only: false,
-  demonstrating_proof_of_possession: false, // demonstrating proof of possession will work only if access_token is accessible from the client (This is because WebCrypto API is not available inside a Service Worker)
+  demonstrating_proof_of_possession: false, 
 };
 
 const href = window.location.href;