#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation')

## ProofKeyThumbprintValidator Class

Syntactic validator for the RFC 9449 §10 `dpop_jkt` authorization\-request
parameter: surfaces malformed thumbprints at the authorize / PAR endpoint with
`invalid_request` instead of letting them slip through to /token where they
would surface only as `invalid_dpop_proof` on the live\-proof comparison —
fail\-fast at the binding\-time endpoint\.

```csharp
public class ProofKeyThumbprintValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → ProofKeyThumbprintValidator

### Remarks
Accepts exactly 43 base64url characters \(no padding\) — the unique encoded length
of an RFC 7638 SHA\-256 JWK thumbprint, the only digest algorithm DPoP uses
\(RFC 9449 §6\.1\)\. Rejects any other length or non\-base64url character\.
The parameter is optional; missing values pass through \(clients that do not
pre\-bind don't pay the cost\)\. The actual thumbprint comparison against a
presented proof happens at the token endpoint inside
`DPoPTokenEndpointValidator`; this step only enforces wire\-format validity\.