[osanderson]

Summary

With Dependencies.Nonces set, PushAuthorizationRequest and BeginBackchannelAuthentication verified the request object (or signed authentication request), recording its jti as used, before verifying the DPoP proof and running the nonce check. A first request without a nonce was refused with use_dpop_nonce after the request object had already been consumed, so the client's retry of the same request with a nonce-bearing proof was refused as a replay (invalid_request_object at PAR, invalid_request at CIBA). RFC 9449 §8 asks the client to retry with the nonce; nothing in RFC 9101 or FAPI 2.0 Message Signing asks it to re-sign the request object. Found by the openid-client interop suite (#818), whose client resends the same signed request object on its nonce retry.

• Both endpoints now verify the optional DPoP proof (its own jti replay record and the nonce) right after client authentication, before the request object, via a shared verifyOptionalDPoPProof.
• reconcileParDPoPBinding / reconcileBackchannelDPoPBinding keep the dpop_jkt match / implicit dpop_jkt logic in the same place, taking the verified proof's thumbprint.
• Error codes and messages are unchanged. One visible ordering change: a request with both an invalid DPoP proof and an invalid request object now reports the DPoP error.
• The srv-ciba-dpop-nonce mutant moves to the shared helper in server/par.go and now also runs the PAR nonce test.
• Interop: the Message Signing instance now runs with nonces on (the -dpop-nonce-challenge=false workaround and its README "Known disagreements" entry are removed).

Not changed: the client assertion (private_key_jwt) and the client attestation PoP are still verified and their jtis recorded in client authentication, before any nonce check, at every endpoint. RFC 7523 §3 lets a server accept a jti only once and clients sign a fresh assertion per request (openid-client does), so a client resending the same assertion on its nonce retry is the client's problem. The token endpoints (authorization code, refresh, CIBA token, client credentials) already check the DPoP nonce before redeeming any code, refresh token or auth_req_id.

Tests

• TestPushAuthorizationRequestNonceChallengeKeepsRequestObjectUsable: PAR with a request object and a nonce-less DPoP proof gets use_dpop_nonce; the same request object with a fresh proof carrying the nonce succeeds; a second successful use is still refused as invalid_request_object.
• TestBackchannelAuthenticationNonceChallengeKeepsRequestUsable: the same shape for a signed CIBA authentication request.
• Both fail against the previous server code and pass with the fix.
• interop/run-openid-client.sh locally: 6/6 legs pass with nonces on for Message Signing; leg 3 fails (invalid_request_object) against the previous server code.
• go test ./..., go vet ./..., golangci-lint run ./... (Go 1.26.10), sqlstore tests (SQLite), mutation check for srv-ciba-dpop-nonce.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.30435% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
server/par.go	89.47%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud