fix(DPoP): mark defaulted dpop_jkt parameter as trusted

panva · Jan 17, 2024 · ee633f3 · ee633f3
1 parent da3198b
commit ee633f3
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/lib/actions/authorization/process_request_object.js b/lib/actions/authorization/process_request_object.js
@@ -285,6 +285,7 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
 
   if (pushedRequestObject && ctx.oidc.entities.PushedAuthorizationRequest.dpopJkt) {
     params.dpop_jkt = ctx.oidc.entities.PushedAuthorizationRequest.dpopJkt;
+    ctx.oidc.trusted?.push('dpop_jkt');
   }
 
   return next();