@opengovsg/mockpass 4.6.7 → 4.6.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -220,7 +220,7 @@ async function verifyDpop(dpop, dpop_jkt, expectedEndpoint) {
|
|
|
220
220
|
const key = await jose.importJWK(jwk, 'ES256')
|
|
221
221
|
await jose.jwtVerify(dpopToken, key, {
|
|
222
222
|
clockTolerance: FapiUtils.dpopConfiguration.DPOP_CLOCK_SKEW,
|
|
223
|
-
requiredClaims: ['jti', 'iat', '
|
|
223
|
+
requiredClaims: ['jti', 'iat', 'htu', 'htm'],
|
|
224
224
|
})
|
|
225
225
|
} catch (error) {
|
|
226
226
|
throw new Error(`Invalid DPoP token signature, ${error.message}`)
|