[java-idp-plugin-vci] 02/05: Accepting access tokens only in authorizarion header as per FAPI 2.0

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/FAPI
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/d44905fdd4df00bc69f04b1e0caf5b188989a27b

commit d44905fdd4df00bc69f04b1e0caf5b188989a27b
Author: Janne Lauros <janne.lauros at csc.fi>
AuthorDate: Mon Sep 28 17:28:11 2026 +0300

    Accepting access tokens only in authorizarion header as per FAPI 2.0
---
 .../impl/OpenIDVCICredentialsRequest.java          | 12 ++++++++++-
 .../impl/OpenIDVCICredentialsRequestTest.java      | 24 ++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
index fa550ee..0ad39f9 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequest.java
@@ -32,6 +32,10 @@ import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.ProtectedResourceRequest;
 import com.nimbusds.oauth2.sdk.http.HTTPRequest;
 import com.nimbusds.oauth2.sdk.token.AccessToken;
+import com.nimbusds.oauth2.sdk.token.AccessTokenType;
+import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.oauth2.sdk.token.BearerTokenError;
+import com.nimbusds.oauth2.sdk.token.DPoPAccessToken;
 
 /**
  * Class partly implementing Open ID VCI Credential Request message as described
@@ -178,7 +182,13 @@ public class OpenIDVCICredentialsRequest extends ProtectedResourceRequest {
     public static OpenIDVCICredentialsRequest parse(final HTTPRequest httpRequest) throws ParseException {
         httpRequest.ensureMethod(HTTPRequest.Method.POST);
         httpRequest.ensureEntityContentType(ContentType.APPLICATION_JSON);
-        final AccessToken accessToken = AccessToken.parse(httpRequest);
+        final String authorization = httpRequest.getAuthorization();
+        if (authorization == null) {
+            throw new ParseException("Missing access token in Authorization header", BearerTokenError.MISSING_TOKEN);
+        }
+        final AccessToken accessToken = authorization.regionMatches(true, 0, AccessTokenType.DPOP.getValue(), 0,
+                AccessTokenType.DPOP.getValue().length()) ? DPoPAccessToken.parse(authorization)
+                        : BearerAccessToken.parse(authorization);
         final Map<String, Object> payload;
         try {
             payload = new ObjectMapper().readValue(httpRequest.getBody(), new TypeReference<Map<String, Object>>() {
diff --git a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequestTest.java b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequestTest.java
index 589eb00..bf6b35f 100644
--- a/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequestTest.java
+++ b/openid-vci-impl/src/test/java/org/geant/shibboleth/plugin/openidvci/messaging/impl/OpenIDVCICredentialsRequestTest.java
@@ -22,6 +22,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.oauth2.sdk.token.DPoPAccessToken;
 import org.testng.Assert;
 
 /**
@@ -65,6 +66,29 @@ public class OpenIDVCICredentialsRequestTest {
         Assert.assertNull(request.getCredentialResponseEncryption());
     }
     
+    @Test
+    public void successDPoP() throws ParseException {
+        httpRequest.setAuthorization("DPoP dGVzdDp0ZXN0");
+        OpenIDVCICredentialsRequest request = OpenIDVCICredentialsRequest.parse(httpRequest);
+        Assert.assertTrue(request.getAccessToken() instanceof DPoPAccessToken);
+        Assert.assertEquals(request.getAccessToken().getValue(), "dGVzdDp0ZXN0");
+    }
+
+    @Test(expectedExceptions = ParseException.class)
+    public void failTokenInQuery() throws Exception {
+        final HTTPRequest queryRequest = new HTTPRequest(HTTPRequest.Method.POST,
+                new URI("http://example.com?access_token=dGVzdDp0ZXN0"));
+        queryRequest.setContentType("application/json");
+        queryRequest.setBody("{\"credential_configuration_id\": \"org.iso.18013.5.1.mDL\"}");
+        OpenIDVCICredentialsRequest.parse(queryRequest);
+    }
+
+    @Test(expectedExceptions = ParseException.class)
+    public void failNoToken() throws ParseException {
+        httpRequest.setAuthorization(null);
+        OpenIDVCICredentialsRequest.parse(httpRequest);
+    }
+
     @Test(expectedExceptions = IllegalArgumentException.class)
     public void failProofAndProofs() throws ParseException {
         httpRequest.setBody("{\n" + "  \"credential_configuration_id\": \"org.iso.18013.5.1.mDL\",\n"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.