@web-ts-toolkit/express-oidc-vault 0.50.0 → 0.51.0

package/README.md

@@ -318,6 +318,47 @@ The shared nonce policy signs versioned, random HMAC-SHA-256 challenges bound to
 
 Sessions, authorization transactions, and exchange codes carry optional `deviceBinding: { type: 'dpop', jkt: string }`; transactions/codes also carry optional `browserBindingHash`. Only the canonical RFC 7638 SHA-256 thumbprint is persisted, without a JWK, private key, proof algorithm, or historical mode. Core retains security-owned binding independently of mutable precreate hooks and issuer inputs. All three built-ins implement live preflight reads, atomic exact/null match-and-consume, lineage revocation context, immutable rotation, and shared bounded replay admission; see the provider contracts below. These store primitives do not themselves verify HTTP proofs.
 
+#### Per-check DPoP failure overrides
+
+Steps 6–8 have independent log-and-continue settings. Each check still runs; an enabled setting writes every failure to the server's `console.warn` and continues to the next check. Both vault POSTs and API middleware read these defaults from `process.env` when constructed:
+
+| Step | Check                                                                               | Environment variable                       | `deviceBinding` option   |
+| ---- | ----------------------------------------------------------------------------------- | ------------------------------------------ | ------------------------ |
+| 6    | HTTP method and normalized pinned URL (`htm`/`htu`), including target normalization | `OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE`    | `ignoreTargetFailure`    |
+| 7    | Signed proof freshness (`iat` age and clock skew)                                   | `OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE` | `ignoreFreshnessFailure` |
+| 8    | Atomic JTI replay admission, including duplicates, capacity, and provider failures  | `OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE`    | `ignoreReplayFailure`    |
+
+Only the exact environment value `true` enables an override; unset, `false`, or any other value retains enforcement. Set whichever flags you need before constructing middleware, for example:
+
+```dotenv
+OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE=true
+OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE=false
+OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE=true
+```
+
+Explicit booleans on `OidcVaultDeviceBindingOptions` / `OidcVaultApiDeviceBindingOptions` take precedence over the environment for that policy:
+
+```ts
+import type { OidcVaultDeviceBindingOptions } from '@web-ts-toolkit/express-oidc-vault';
+
+const deviceBinding: OidcVaultDeviceBindingOptions = {
+  mode: 'required',
+  ignoreTargetFailure: true,
+  ignoreFreshnessFailure: false,
+  ignoreReplayFailure: false,
+};
+```
+
+An ignored freshness failure still reaches nonce verification and replay admission. To give replay admission a live bounded expiry independently of the rejected `iat`, core uses `now + (proofMaxAgeSeconds + clockSkewSeconds) * 1000` (65 seconds with defaults). A failed configured proof clock is logged and falls back to `Date.now`. Successful replay reservations retain their expiry; duplicates never renew them, even when their failure is ignored. Signature, header/JWK, claim-shape, original-key, API `ath`, and nonce checks retain their normal enforcement.
+
+Console output identifies the step, option/environment variable, and original error (including replay provider causes), for example:
+
+```text
+[express-oidc-vault] DPoP step 8 (replay) failed; continuing (ignoreReplayFailure=true; OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE).
+```
+
+Environment changes take effect on newly constructed middleware. Ignored failures go directly to the console; `onError` handles failures that stop the request.
+
 ### POST login and browser-authenticated callback
 
 Configure the vault with the existing stronger store and an opt-in policy:
@@ -1443,9 +1484,9 @@ DPoP replay is a reservation per accepted proof, including API traffic; it is su
 
 `expiresAt` is a future safe-integer epoch in milliseconds, with at most **360000 ms** remaining. Invalid, fractional, unsafe, nonfinite, expired (`<= now`), or overlong windows return `false` without allocation. Valid expired keys may be reserved again. All instances must use identical namespaces/proof windows and synchronized clocks. The approved proof defaults retain at most 70 seconds of validity; provision capacity for unique proofs/second × retained window plus headroom.
 
-Core derives `replayKey = 'dpop:v1:' + base64url(SHA-256(JSON([effectiveNamespace, jkt, jti])))` and expiry **`(iat + proofMaxAgeSeconds + clockSkewSeconds) * 1000`**. Vault space is `['vault', normalizedBackendOrigin, normalizedBasePath, exactIssuer, exactClientId]`; API space is `['api', normalizedPublicOrigin, replayNamespace]`. API path prefix is a target correction, not replay partitioning. The 360000ms ceiling includes future iat skew (maximum age 300 + twice skew 30); no duplicate extends its reservation.
+Core derives `replayKey = 'dpop:v1:' + base64url(SHA-256(JSON([effectiveNamespace, jkt, jti])))` and expiry **`(iat + proofMaxAgeSeconds + clockSkewSeconds) * 1000`**. An explicitly ignored freshness failure instead uses the bounded current-time expiry described under [per-check overrides](#per-check-dpop-failure-overrides). Vault space is `['vault', normalizedBackendOrigin, normalizedBasePath, exactIssuer, exactClientId]`; API space is `['api', normalizedPublicOrigin, replayNamespace]`. API path prefix is a target correction, not replay partitioning. The 360000ms ceiling includes future iat skew (maximum age 300 + twice skew 30); no duplicate extends its reservation.
 
-Every provider accepts `dpopReplayMaxEntries?: number`, default **100000**, positive safe integer. Capacity is per memory object, Redis prefix, or paired Mongo replay collections, shared across backend clients. Configure the same limit on every shared client. Duplicates return `false` even when full; new reservations throw root-exported `OidcVaultDpopReplayCapacityError` at capacity. Live reservations are never evicted and store failure never permits acceptance. API middleware and all DPoP-bearing vault POSTs map failures/capacity to sanitized `503 OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE`.
+Every provider accepts `dpopReplayMaxEntries?: number`, default **100000**, positive safe integer. Capacity is per memory object, Redis prefix, or paired Mongo replay collections, shared across backend clients. Configure the same limit on every shared client. Duplicates return `false` even when full; new reservations throw root-exported `OidcVaultDpopReplayCapacityError` at capacity. Live reservations are never evicted. By default, API middleware and all DPoP-bearing vault POSTs map failures/capacity to sanitized `503 OIDC_VAULT_DPOP_REPLAY_UNAVAILABLE`; `ignoreReplayFailure` logs these failures and continues after attempting admission.
 
 | Provider | Admission/expiry work                                                                                                                                                                                                                                                                                                                                               |
 | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -1891,7 +1932,7 @@ Authorization: DPoP <local-access-token>
 DPoP: <fresh-signed-proof-jwt>
 ```
 
-The proof has protected `{ typ: 'dpop+jwt', alg: 'ES256', jwk: <public-P-256-JWK> }` and signed `htm`, absolute `htu` without query/fragment, integer `iat`, fresh `jti`, and API `ath = base64url(SHA-256(ASCII(accessToken)))`. A configured nonce also supplies the signed `nonce`. Signature verification precedes payload/target/key/hash checks. Private/symmetric/remote-key JWKs, critical headers, wrong key/signature/method/URL/hash, and duplicate/stale/replayed proofs fail. Bounds: compact proof 8192 bytes, decoded protected header/JWK 2048 bytes, printable ASCII JTI 1–128 bytes, nonce at most 512 bytes. Raw duplicate Authorization/DPoP fields and comma-joined credentials/proofs are rejected. Generate at least 128 random bits for every JTI and a new proof for every request/retry.
+The proof has protected `{ typ: 'dpop+jwt', alg: 'ES256', jwk: <public-P-256-JWK> }` and signed `htm`, absolute `htu` without query/fragment, integer `iat`, fresh `jti`, and API `ath = base64url(SHA-256(ASCII(accessToken)))`. A configured nonce also supplies the signed `nonce`. Signature verification precedes payload/target/key/hash checks. By default, private/symmetric/remote-key JWKs, critical headers, wrong key/signature/method/URL/hash, and duplicate/stale/replayed proofs fail. The independent [per-check overrides](#per-check-dpop-failure-overrides) apply to method/URL, freshness, and replay failures. Bounds: compact proof 8192 bytes, decoded protected header/JWK 2048 bytes, printable ASCII JTI 1–128 bytes, nonce at most 512 bytes. Raw duplicate Authorization/DPoP fields and comma-joined credentials/proofs are rejected. Generate at least 128 random bits for every JTI and a new proof for every request/retry.
 
 For optional unbound Bearer requests, an omitted proof stays on the unbound path. If a proof is supplied, it must still pass signature/target/API `ath`/nonce/shared replay and never creates `auth.deviceBinding`.
 
@@ -1899,7 +1940,7 @@ API replay uses the shared `['api', normalizedPublicOrigin, replayNamespace]` pr
 
 #### API errors and nonce retry
 
-For the default ES256 policy (`algs` lists the configured allowlist in order):
+With default failure enforcement and the ES256 policy (`algs` lists the configured allowlist in order):
 
 | Condition                                                  | HTTP / code                                                                  | `WWW-Authenticate`                              |
 | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------- |
@@ -1933,7 +1974,7 @@ Vault routes and API middleware return sanitized `{ code, message }`. Invalid pr
 | 400                 | `OIDC_VAULT_INVALID_FINGERPRINT`           | `Fingerprint signal is invalid.`                   |
 | 403                 | `OIDC_VAULT_FINGERPRINT_REAUTH_REQUIRED`   | `Browser recognition changed; sign in again.`      |
 
-Source failures retain `403 OIDC_VAULT_UNTRUSTED_ORIGIN` with `Login request origin is not trusted.` / `Exchange request origin is not trusted.` / `Refresh request origin is not trusted.` / `Logout request origin is not trusted.`. An authenticated provider-error callback returns fixed `400 OIDC_VAULT_CALLBACK_ERROR` / `OIDC callback failed.`. Replay storage failure/capacity is a fail-closed 503 with no auth challenge; invalid/missing proof 401s use `invalid_dpop_proof`, and API nonce 401s use `use_dpop_nonce`. Vault nonce 400s carry the one `DPoP-Nonce` header without `WWW-Authenticate`. Every response retains `no-store`; original errors reach `hooks.onError` or the separate API `onError`, with replay provider diagnostics in `error.cause`.
+Source failures retain `403 OIDC_VAULT_UNTRUSTED_ORIGIN` with `Login request origin is not trusted.` / `Exchange request origin is not trusted.` / `Refresh request origin is not trusted.` / `Logout request origin is not trusted.`. An authenticated provider-error callback returns fixed `400 OIDC_VAULT_CALLBACK_ERROR` / `OIDC callback failed.`. With default enforcement, replay storage failure/capacity is a fail-closed 503 with no auth challenge; invalid/missing proof 401s use `invalid_dpop_proof`, and API nonce 401s use `use_dpop_nonce`. Vault nonce 400s carry the one `DPoP-Nonce` header without `WWW-Authenticate`. Every response retains `no-store`; failures that stop the request reach `hooks.onError` or the separate API `onError`, with replay provider diagnostics in `error.cause`. Independently ignored failures are logged to `console.warn` as described under [per-check overrides](#per-check-dpop-failure-overrides).
 
 Recommended separation:
 

package/index.d.mts

@@ -41,6 +41,8 @@ interface OidcVaultDpopNonceOptions {
  * Signature verification precedes claims; strict iat validity is
  * nowSeconds - age - skew < iat <= nowSeconds + skew. APIs additionally match
  * original verified cnf.jkt and SHA-256 ath of the ASCII access token.
+ * Independent failure overrides below run their checks and log to console.warn
+ * before continuing. Environment defaults are captured at middleware construction.
  */
 interface OidcVaultDpopProofOptions {
     /** Nonempty asymmetric allowlist; default `['ES256']` (P-256). RSA proofs require 2048–4096 bits. */
@@ -51,6 +53,24 @@ interface OidcVaultDpopProofOptions {
     clockSkewSeconds?: number;
     /** Off by default. Challenges are at most 512 bytes; retry once with a fresh proof, never reuse its JTI. */
     nonce?: false | OidcVaultDpopNonceOptions;
+    /**
+     * Step 6: log failed method/normalized URL checks and continue.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE === 'true'; otherwise false.
+     * An explicit boolean overrides the environment for this vault/API policy.
+     */
+    ignoreTargetFailure?: boolean;
+    /**
+     * Step 7: log failed proof age/skew checks and continue, retaining replay tracking
+     * with a bounded expiry from the current time. A failed clock uses Date.now.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE === 'true'; otherwise false.
+     */
+    ignoreFreshnessFailure?: boolean;
+    /**
+     * Step 8: attempt atomic replay reservation, log duplicate/admission/provider
+     * failures, and continue. Successful reservations retain their normal lifetime.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE === 'true'; otherwise false.
+     */
+    ignoreReplayFailure?: boolean;
 }
 /**
  * Opt-in sender constraint. `optional` permits legacy unbound records without
@@ -273,10 +293,11 @@ interface OidcVaultDpopReplayStore {
     /**
      * Reserve once through expiry. Duplicate/invalid/expired input returns false
      * without extending expiry or allocating state. Capacity/provider failures
-     * throw; callers must fail closed, never evict live reservations. Built-ins
+     * throw; callers fail closed by default, never evict live reservations. Built-ins
      * default to 100000 entries per shared namespace. Expired entries awaiting
      * bounded cleanup may conservatively occupy capacity. Duplicate detection
      * precedes capacity rejection; capacity throws `OidcVaultDpopReplayCapacityError`.
+     * A proof policy with ignoreReplayFailure logs a failed admission and continues.
      */
     reserveDpopProof(input: ReserveDpopProofInput): Promise<boolean>;
 }
@@ -937,6 +958,10 @@ declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
  * callbacks/validator methods, URLs, algorithms and secret bytes; the replay
  * store remains the shared atomic service. Responses carry no-store and fixed
  * errors; onError privately observes originals and cannot override failures.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured at construction; ignored failures log to
+ * console.warn. Explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
 
@@ -985,6 +1010,10 @@ declare function normalizeOidcVaultBasePath(value?: string): string;
  * an enabled nonce secret is copied into private owned storage. Separate opt-in
  * `fingerprintRecognition` settings are detached/frozen; recognition enrolls
  * only at POST login and checks exchange/refresh before credential mutation.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured with the proof policy. Ignored failures
+ * log to console.warn; explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 

package/index.d.ts

@@ -41,6 +41,8 @@ interface OidcVaultDpopNonceOptions {
  * Signature verification precedes claims; strict iat validity is
  * nowSeconds - age - skew < iat <= nowSeconds + skew. APIs additionally match
  * original verified cnf.jkt and SHA-256 ath of the ASCII access token.
+ * Independent failure overrides below run their checks and log to console.warn
+ * before continuing. Environment defaults are captured at middleware construction.
  */
 interface OidcVaultDpopProofOptions {
     /** Nonempty asymmetric allowlist; default `['ES256']` (P-256). RSA proofs require 2048–4096 bits. */
@@ -51,6 +53,24 @@ interface OidcVaultDpopProofOptions {
     clockSkewSeconds?: number;
     /** Off by default. Challenges are at most 512 bytes; retry once with a fresh proof, never reuse its JTI. */
     nonce?: false | OidcVaultDpopNonceOptions;
+    /**
+     * Step 6: log failed method/normalized URL checks and continue.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE === 'true'; otherwise false.
+     * An explicit boolean overrides the environment for this vault/API policy.
+     */
+    ignoreTargetFailure?: boolean;
+    /**
+     * Step 7: log failed proof age/skew checks and continue, retaining replay tracking
+     * with a bounded expiry from the current time. A failed clock uses Date.now.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE === 'true'; otherwise false.
+     */
+    ignoreFreshnessFailure?: boolean;
+    /**
+     * Step 8: attempt atomic replay reservation, log duplicate/admission/provider
+     * failures, and continue. Successful reservations retain their normal lifetime.
+     * Defaults to OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE === 'true'; otherwise false.
+     */
+    ignoreReplayFailure?: boolean;
 }
 /**
  * Opt-in sender constraint. `optional` permits legacy unbound records without
@@ -273,10 +293,11 @@ interface OidcVaultDpopReplayStore {
     /**
      * Reserve once through expiry. Duplicate/invalid/expired input returns false
      * without extending expiry or allocating state. Capacity/provider failures
-     * throw; callers must fail closed, never evict live reservations. Built-ins
+     * throw; callers fail closed by default, never evict live reservations. Built-ins
      * default to 100000 entries per shared namespace. Expired entries awaiting
      * bounded cleanup may conservatively occupy capacity. Duplicate detection
      * precedes capacity rejection; capacity throws `OidcVaultDpopReplayCapacityError`.
+     * A proof policy with ignoreReplayFailure logs a failed admission and continues.
      */
     reserveDpopProof(input: ReserveDpopProofInput): Promise<boolean>;
 }
@@ -937,6 +958,10 @@ declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
  * callbacks/validator methods, URLs, algorithms and secret bytes; the replay
  * store remains the shared atomic service. Responses carry no-store and fixed
  * errors; onError privately observes originals and cannot override failures.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured at construction; ignored failures log to
+ * console.warn. Explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
 
@@ -985,6 +1010,10 @@ declare function normalizeOidcVaultBasePath(value?: string): string;
  * an enabled nonce secret is copied into private owned storage. Separate opt-in
  * `fingerprintRecognition` settings are detached/frozen; recognition enrolls
  * only at POST login and checks exchange/refresh before credential mutation.
+ * The independent OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE,
+ * OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE and OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE
+ * environment defaults are captured with the proof policy. Ignored failures
+ * log to console.warn; explicit deviceBinding booleans override those defaults.
  */
 declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
 

package/index.js

@@ -290,6 +290,26 @@ var parseSelectedCookieValue = (headerValue, selectedName) => {
 
 // src/device-binding-policy.ts
 var import_node_net = require("net");
+
+// src/dpop-failure-policy.ts
+var CHECKS = {
+  target: { step: 6, option: "ignoreTargetFailure", env: "OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE" },
+  freshness: { step: 7, option: "ignoreFreshnessFailure", env: "OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE" },
+  replay: { step: 8, option: "ignoreReplayFailure", env: "OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE" }
+};
+var resolveDpopFailureOption = (value, check) => {
+  const { option, env } = CHECKS[check];
+  if (value === void 0) return process.env[env] === "true";
+  if (typeof value !== "boolean") throw new TypeError(`deviceBinding.${option} must be a boolean.`);
+  return value;
+};
+var handleDpopCheckFailure = (ignore, check, error) => {
+  if (!ignore) throw error;
+  const { step, option, env } = CHECKS[check];
+  console.warn(`[express-oidc-vault] DPoP step ${step} (${check}) failed; continuing (${option}=true; ${env}).`, error);
+};
+
+// src/device-binding-policy.ts
 var isPlainRecord = (value) => {
   if (typeof value !== "object" || value === null) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -306,7 +326,16 @@ var resolveInteger = (value, fallback, min, max, name) => {
 var resolveDeviceBindingOptions = (value) => {
   if (value === void 0) return void 0;
   if (!isPlainRecord(value)) throw new Error("deviceBinding must be a plain options object.");
-  const { mode, algorithms, proofMaxAgeSeconds, clockSkewSeconds, nonce } = value;
+  const {
+    mode,
+    algorithms,
+    proofMaxAgeSeconds,
+    clockSkewSeconds,
+    nonce,
+    ignoreTargetFailure,
+    ignoreFreshnessFailure,
+    ignoreReplayFailure
+  } = value;
   if (mode !== void 0 && mode !== "optional" && mode !== "required") {
     throw new Error("deviceBinding.mode must be optional or required.");
   }
@@ -338,7 +367,10 @@ var resolveDeviceBindingOptions = (value) => {
     algorithms: Object.freeze([...new Set(allowlist)]),
     proofMaxAgeSeconds: resolveInteger(proofMaxAgeSeconds, 60, 1, 300, "deviceBinding.proofMaxAgeSeconds"),
     clockSkewSeconds: resolveInteger(clockSkewSeconds, 5, 0, 30, "deviceBinding.clockSkewSeconds"),
-    nonce: resolvedNonce
+    nonce: resolvedNonce,
+    ignoreTargetFailure: resolveDpopFailureOption(ignoreTargetFailure, "target"),
+    ignoreFreshnessFailure: resolveDpopFailureOption(ignoreFreshnessFailure, "freshness"),
+    ignoreReplayFailure: resolveDpopFailureOption(ignoreReplayFailure, "replay")
   });
 };
 var DEVICE_BINDING_STORE_CAPABILITIES = [
@@ -669,6 +701,7 @@ var publicJwk = (value, alg) => {
 var verifyDpopProof = async (input) => {
   const { proof, method, targetUrl, proofOptions, expectedJkt, accessToken } = input;
   const algorithms = [...proofOptions.algorithms];
+  const { ignoreTargetFailure } = proofOptions;
   extractDpopProof({ count: 1, value: proof });
   const [encodedHeader, encodedPayload, encodedSignature] = proof.split(".");
   const header = parseObject(decodeBase64url2(encodedHeader, DPOP_PROTECTED_HEADER_MAX_BYTES));
@@ -694,8 +727,13 @@ var verifyDpopProof = async (input) => {
   if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || typeof jti !== "string" || jti.length < 1 || jti.length > 128 || /[^\x20-\x7e]/.test(jti)) {
     throw invalidProof("DPoP signed iat/JTI must be nonnegative integer time and bounded printable ASCII.");
   }
-  if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== targetUrl) {
-    throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+  try {
+    const expectedTarget = typeof targetUrl === "function" ? targetUrl() : targetUrl;
+    if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== expectedTarget) {
+      throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+    }
+  } catch (error) {
+    handleDpopCheckFailure(ignoreTargetFailure, "target", error);
   }
   if (typeof nonce === "string" && (nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
     throw invalidProof("DPoP signed nonce exceeds its byte bound.");
@@ -2309,8 +2347,8 @@ var createDpopReplayPolicy = (options) => {
         throw invalidProof2("DPoP verifier did not return a verified key binding.");
       }
       const { type, jkt, alg } = verifiedBinding;
-      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti)) {
-        throw invalidProof2("DPoP verified key/algorithm or signed JTI shape is invalid.");
+      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti) || typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0) {
+        throw invalidProof2("DPoP verified key/algorithm or signed iat/JTI shape is invalid.");
       }
       const binding = Object.freeze({ type, jkt, alg });
       let checkedNow;
@@ -2318,10 +2356,20 @@ var createDpopReplayPolicy = (options) => {
         checkedNow = now();
         if (!Number.isSafeInteger(checkedNow) || checkedNow < 0) throw new TypeError("DPoP replay clock is invalid.");
       } catch (error) {
-        throw replayUnavailable(error);
+        handleDpopCheckFailure(policy.ignoreFreshnessFailure, "freshness", replayUnavailable(error));
+        checkedNow = Date.now();
+        if (!Number.isSafeInteger(checkedNow) || checkedNow < 0)
+          throw replayUnavailable(new TypeError("DPoP fallback clock is invalid."));
+      }
+      let expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
+      if (expiresAt === null) {
+        handleDpopCheckFailure(
+          policy.ignoreFreshnessFailure,
+          "freshness",
+          invalidProof2("DPoP signed iat is outside the bounded replay window.")
+        );
+        expiresAt = checkedNow + (policy.proofMaxAgeSeconds + policy.clockSkewSeconds) * 1e3;
       }
-      const expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
-      if (expiresAt === null) throw invalidProof2("DPoP signed iat is outside the bounded replay window.");
       if (noncePolicy) {
         if (!noncePolicy.verify(nonce, jkt, checkedNow)) {
           return Object.freeze({ type: "nonce-challenge", nonce: noncePolicy.issue(jkt, checkedNow) });
@@ -2329,18 +2377,19 @@ var createDpopReplayPolicy = (options) => {
       } else if (nonce !== void 0 && (typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
         throw invalidProof2("DPoP signed nonce claim exceeds its string/byte bound.");
       }
-      let reserved;
+      let reservationError;
       try {
-        reserved = await replayStore.reserveDpopProof({
+        const reserved = await replayStore.reserveDpopProof({
           replayKey: createDpopReplayKey(effectiveNamespace, jkt, jti),
           expiresAt
         });
         if (typeof reserved !== "boolean")
           throw new TypeError("DPoP replay store returned a non-boolean admission result.");
+        if (!reserved) reservationError = invalidProof2("DPoP replay reservation was duplicate or no longer live.");
       } catch (error) {
-        throw replayUnavailable(error);
+        reservationError = replayUnavailable(error);
       }
-      if (!reserved) throw invalidProof2("DPoP replay reservation was duplicate or no longer live.");
+      if (reservationError) handleDpopCheckFailure(policy.ignoreReplayFailure, "replay", reservationError);
       return Object.freeze({ type: "accepted", binding, expiresAt });
     }
   });
@@ -2403,12 +2452,11 @@ var createVaultRouteProofVerifier = (options, config, backendOrigin, basePath) =
     now: options.now
   });
   const admit = async (request, proof, expectedJkt) => {
-    const targetUrl = targetFor(request.originalUrl);
     const result = await replay.verifyAndReserve(
       () => verifyDpopProof({
         proof,
         method: request.method,
-        targetUrl,
+        targetUrl: () => targetFor(request.originalUrl),
         proofOptions: policy,
         expectedJkt
       })
@@ -2589,12 +2637,11 @@ function createOidcVaultAccessTokenMiddleware(options) {
         if (!proof && confirmation)
           throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
         if (proof) {
-          const targetUrl = targetFor(originalUrl);
           const admission = await replay.verifyAndReserve(
             () => verifyDpopProof({
               proof,
               method,
-              targetUrl,
+              targetUrl: () => targetFor(originalUrl),
               proofOptions: policy,
               accessToken: token,
               expectedJkt: confirmation?.jkt

package/index.mjs

@@ -242,6 +242,26 @@ var parseSelectedCookieValue = (headerValue, selectedName) => {
 
 // src/device-binding-policy.ts
 import { isIP } from "net";
+
+// src/dpop-failure-policy.ts
+var CHECKS = {
+  target: { step: 6, option: "ignoreTargetFailure", env: "OIDC_VAULT_DPOP_IGNORE_TARGET_FAILURE" },
+  freshness: { step: 7, option: "ignoreFreshnessFailure", env: "OIDC_VAULT_DPOP_IGNORE_FRESHNESS_FAILURE" },
+  replay: { step: 8, option: "ignoreReplayFailure", env: "OIDC_VAULT_DPOP_IGNORE_REPLAY_FAILURE" }
+};
+var resolveDpopFailureOption = (value, check) => {
+  const { option, env } = CHECKS[check];
+  if (value === void 0) return process.env[env] === "true";
+  if (typeof value !== "boolean") throw new TypeError(`deviceBinding.${option} must be a boolean.`);
+  return value;
+};
+var handleDpopCheckFailure = (ignore, check, error) => {
+  if (!ignore) throw error;
+  const { step, option, env } = CHECKS[check];
+  console.warn(`[express-oidc-vault] DPoP step ${step} (${check}) failed; continuing (${option}=true; ${env}).`, error);
+};
+
+// src/device-binding-policy.ts
 var isPlainRecord = (value) => {
   if (typeof value !== "object" || value === null) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -258,7 +278,16 @@ var resolveInteger = (value, fallback, min, max, name) => {
 var resolveDeviceBindingOptions = (value) => {
   if (value === void 0) return void 0;
   if (!isPlainRecord(value)) throw new Error("deviceBinding must be a plain options object.");
-  const { mode, algorithms, proofMaxAgeSeconds, clockSkewSeconds, nonce } = value;
+  const {
+    mode,
+    algorithms,
+    proofMaxAgeSeconds,
+    clockSkewSeconds,
+    nonce,
+    ignoreTargetFailure,
+    ignoreFreshnessFailure,
+    ignoreReplayFailure
+  } = value;
   if (mode !== void 0 && mode !== "optional" && mode !== "required") {
     throw new Error("deviceBinding.mode must be optional or required.");
   }
@@ -290,7 +319,10 @@ var resolveDeviceBindingOptions = (value) => {
     algorithms: Object.freeze([...new Set(allowlist)]),
     proofMaxAgeSeconds: resolveInteger(proofMaxAgeSeconds, 60, 1, 300, "deviceBinding.proofMaxAgeSeconds"),
     clockSkewSeconds: resolveInteger(clockSkewSeconds, 5, 0, 30, "deviceBinding.clockSkewSeconds"),
-    nonce: resolvedNonce
+    nonce: resolvedNonce,
+    ignoreTargetFailure: resolveDpopFailureOption(ignoreTargetFailure, "target"),
+    ignoreFreshnessFailure: resolveDpopFailureOption(ignoreFreshnessFailure, "freshness"),
+    ignoreReplayFailure: resolveDpopFailureOption(ignoreReplayFailure, "replay")
   });
 };
 var DEVICE_BINDING_STORE_CAPABILITIES = [
@@ -621,6 +653,7 @@ var publicJwk = (value, alg) => {
 var verifyDpopProof = async (input) => {
   const { proof, method, targetUrl, proofOptions, expectedJkt, accessToken } = input;
   const algorithms = [...proofOptions.algorithms];
+  const { ignoreTargetFailure } = proofOptions;
   extractDpopProof({ count: 1, value: proof });
   const [encodedHeader, encodedPayload, encodedSignature] = proof.split(".");
   const header = parseObject(decodeBase64url2(encodedHeader, DPOP_PROTECTED_HEADER_MAX_BYTES));
@@ -646,8 +679,13 @@ var verifyDpopProof = async (input) => {
   if (typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0 || typeof jti !== "string" || jti.length < 1 || jti.length > 128 || /[^\x20-\x7e]/.test(jti)) {
     throw invalidProof("DPoP signed iat/JTI must be nonnegative integer time and bounded printable ASCII.");
   }
-  if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== targetUrl) {
-    throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+  try {
+    const expectedTarget = typeof targetUrl === "function" ? targetUrl() : targetUrl;
+    if (htm !== method || typeof method !== "string" || method.length === 0 || normalizeDpopProofTarget(htu) !== expectedTarget) {
+      throw invalidProof("DPoP signed method or normalized public target does not match this request.");
+    }
+  } catch (error) {
+    handleDpopCheckFailure(ignoreTargetFailure, "target", error);
   }
   if (typeof nonce === "string" && (nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
     throw invalidProof("DPoP signed nonce exceeds its byte bound.");
@@ -2261,8 +2299,8 @@ var createDpopReplayPolicy = (options) => {
         throw invalidProof2("DPoP verifier did not return a verified key binding.");
       }
       const { type, jkt, alg } = verifiedBinding;
-      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti)) {
-        throw invalidProof2("DPoP verified key/algorithm or signed JTI shape is invalid.");
+      if (type !== "dpop" || !isCanonicalDpopJkt(jkt) || !isDpopAlgorithm(alg) || !policy.algorithms.includes(alg) || !isPrintableIdentifier(jti) || typeof iat !== "number" || !Number.isSafeInteger(iat) || iat < 0) {
+        throw invalidProof2("DPoP verified key/algorithm or signed iat/JTI shape is invalid.");
       }
       const binding = Object.freeze({ type, jkt, alg });
       let checkedNow;
@@ -2270,10 +2308,20 @@ var createDpopReplayPolicy = (options) => {
         checkedNow = now();
         if (!Number.isSafeInteger(checkedNow) || checkedNow < 0) throw new TypeError("DPoP replay clock is invalid.");
       } catch (error) {
-        throw replayUnavailable(error);
+        handleDpopCheckFailure(policy.ignoreFreshnessFailure, "freshness", replayUnavailable(error));
+        checkedNow = Date.now();
+        if (!Number.isSafeInteger(checkedNow) || checkedNow < 0)
+          throw replayUnavailable(new TypeError("DPoP fallback clock is invalid."));
+      }
+      let expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
+      if (expiresAt === null) {
+        handleDpopCheckFailure(
+          policy.ignoreFreshnessFailure,
+          "freshness",
+          invalidProof2("DPoP signed iat is outside the bounded replay window.")
+        );
+        expiresAt = checkedNow + (policy.proofMaxAgeSeconds + policy.clockSkewSeconds) * 1e3;
       }
-      const expiresAt = getDpopReplayExpiresAt({ ...policy, iat, now: checkedNow });
-      if (expiresAt === null) throw invalidProof2("DPoP signed iat is outside the bounded replay window.");
       if (noncePolicy) {
         if (!noncePolicy.verify(nonce, jkt, checkedNow)) {
           return Object.freeze({ type: "nonce-challenge", nonce: noncePolicy.issue(jkt, checkedNow) });
@@ -2281,18 +2329,19 @@ var createDpopReplayPolicy = (options) => {
       } else if (nonce !== void 0 && (typeof nonce !== "string" || nonce.length > DPOP_NONCE_MAX_BYTES || Buffer.byteLength(nonce, "utf8") > DPOP_NONCE_MAX_BYTES)) {
         throw invalidProof2("DPoP signed nonce claim exceeds its string/byte bound.");
       }
-      let reserved;
+      let reservationError;
       try {
-        reserved = await replayStore.reserveDpopProof({
+        const reserved = await replayStore.reserveDpopProof({
           replayKey: createDpopReplayKey(effectiveNamespace, jkt, jti),
           expiresAt
         });
         if (typeof reserved !== "boolean")
           throw new TypeError("DPoP replay store returned a non-boolean admission result.");
+        if (!reserved) reservationError = invalidProof2("DPoP replay reservation was duplicate or no longer live.");
       } catch (error) {
-        throw replayUnavailable(error);
+        reservationError = replayUnavailable(error);
       }
-      if (!reserved) throw invalidProof2("DPoP replay reservation was duplicate or no longer live.");
+      if (reservationError) handleDpopCheckFailure(policy.ignoreReplayFailure, "replay", reservationError);
       return Object.freeze({ type: "accepted", binding, expiresAt });
     }
   });
@@ -2355,12 +2404,11 @@ var createVaultRouteProofVerifier = (options, config, backendOrigin, basePath) =
     now: options.now
   });
   const admit = async (request, proof, expectedJkt) => {
-    const targetUrl = targetFor(request.originalUrl);
     const result = await replay.verifyAndReserve(
       () => verifyDpopProof({
         proof,
         method: request.method,
-        targetUrl,
+        targetUrl: () => targetFor(request.originalUrl),
         proofOptions: policy,
         expectedJkt
       })
@@ -2541,12 +2589,11 @@ function createOidcVaultAccessTokenMiddleware(options) {
         if (!proof && confirmation)
           throw new OidcVaultHttpError(401, "OIDC_VAULT_DPOP_REQUIRED", "DPoP authentication is required.");
         if (proof) {
-          const targetUrl = targetFor(originalUrl);
           const admission = await replay.verifyAndReserve(
             () => verifyDpopProof({
               proof,
               method,
-              targetUrl,
+              targetUrl: () => targetFor(originalUrl),
               proofOptions: policy,
               accessToken: token,
               expectedJkt: confirmation?.jkt

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/express-oidc-vault",
   "description": "Express OIDC sessions with body or cookie transport, optional DPoP-bound local JWTs, and pluggable vault stores",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/express-oidc-vault",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "sideEffects": false,
   "keywords": [
     "express",