#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation Namespace

| Classes | |
| :--- | :--- |
| [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') | Resource\-server\-side enforcement of RFC 9449 DPoP at the UserInfo endpoint\. Mirrors the shape of [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') so the branching logic stays symmetric across endpoints; differences are limited to the trigger \(`cnf.jkt` on the inbound access token\) and the error envelope \(typed [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') / [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') so the response formatter can emit the §7\.1 `WWW-Authenticate: DPoP` challenge\)\. |
| [MtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.MtlsUserInfoValidator') | Resource\-server\-side enforcement of RFC 8705 §3 mutual\-TLS certificate\-bound access tokens at the UserInfo endpoint\. Mirrors the role of [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') for the `cnf.x5t#S256` binding: when the access token is certificate\-bound, the SHA\-256 thumbprint of the certificate presented on the mutual\-TLS connection MUST match the bound value, otherwise the request is rejected with `invalid_token` \(HTTP 401, per RFC 6750\)\. |