#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation')

## SecurityProfileRequirements Class

The bundle of controls a [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') forces on a client, expressed as
individual flags the request\-pipeline validators consult\. This is the single place the
profile\-to\-controls mapping lives, so a validator never needs to know what "FAPI 2\.0" means — it
only reads the one flag it owns — and adding a future profile touches only [Resolve\(ClientSecurityProfile\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile) 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.Resolve\(Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\)')\.

```csharp
public sealed record SecurityProfileRequirements : System.IEquatable<Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecurityProfileRequirements

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')

### Remarks
Each flag is enforcement\-only: it can require a control but never relax one\. A profile therefore
tightens a client and cannot weaken it, which is the invariant that lets a granular toggle \(for
example [PkceRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PkceRequired 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.PkceRequired') set to `false`\) coexist with a profile without
silently downgrading it\.

Every flag below names the validator that enforces it\. That coupling is documented here on
purpose: the enforcement is distributed across the request pipeline, so a new flag added to a
profile without a matching consumer would ship silently unenforced\. When adding a flag, wire a
validator that reads it and a test that proves the control fires\.
### Properties

## SecurityProfileRequirements\.RequireCodeResponseTypeOnly Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireCodeResponseTypeOnly}

The profile permits only the authorization\-code response type, rejecting any implicit or
hybrid response type that returns a token or id\_token from the authorization endpoint\.
Enforced by `Endpoints.Authorization.Validation.FlowTypeValidator` at request time and
by [SecurityProfileConsistency](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileConsistency') as a fail\-loud registration/startup check\.

```csharp
public bool RequireCodeResponseTypeOnly { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## SecurityProfileRequirements\.RequirePkce Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequirePkce}

The profile mandates PKCE on every authorization request, even when the client's own
[PkceRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PkceRequired 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.PkceRequired') is `false`\. Enforced by
`Endpoints.Authorization.Validation.PkceValidator`\.

```csharp
public bool RequirePkce { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## SecurityProfileRequirements\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequirePushedAuthorizationRequests}

The profile requires the client to start every authorization flow through a Pushed
Authorization Request, independent of the server\-wide
[RequirePushedAuthorizationRequests](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequirePushedAuthorizationRequests 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequirePushedAuthorizationRequests') flag\.
Enforced by `Endpoints.Authorization.RequestFetching.PushedRequestFetcher`\.

```csharp
public bool RequirePushedAuthorizationRequests { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## SecurityProfileRequirements\.RequireS256CodeChallenge Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireS256CodeChallenge}

The profile restricts the PKCE code challenge method to exactly `S256`, rejecting both
`plain` and the non\-standard `S512` extension\. FAPI 2\.0 names `S256`, and the
IANA "PKCE Code Challenge Methods" registry defines only `plain` and `S256`, so a
conformance suite never presents `S512`\. Enforced by
`Endpoints.Authorization.Validation.PkceValidator`\.

```csharp
public bool RequireS256CodeChallenge { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## SecurityProfileRequirements\.RequireSenderConstrainedTokens Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireSenderConstrainedTokens}

The profile requires a sender\-constrained access token, satisfied by either a DPoP proof
\(RFC 9449\) or a certificate\-bound token over mutual TLS \(RFC 8705 §3\)\. Enforced by
`Endpoints.Token.Validation.DPoPTokenEndpointValidator`\.

```csharp
public bool RequireSenderConstrainedTokens { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')

## SecurityProfileRequirements\.RequireStrictRequestObjectProcessing Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireStrictRequestObjectProcessing}

The profile requires strict RFC 9101 §6\.3 request\-object processing: only the parameters inside the
request object are used and any parameter passed outside it is ignored, instead of the OpenID Connect
Core §6\.1 merge behaviour\. FAPI 2\.0 mandates JWT\-Secured Authorization Requests with this exclusivity\.
Enforced by `Features.RequestObject.RequestObjectFetcher`\.

```csharp
public bool RequireStrictRequestObjectProcessing { get; init; }
```

#### Property Value
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')
### Methods

## SecurityProfileRequirements\.Effective\(Nullable\<ClientSecurityProfile\>, ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Effective(System.Nullable_Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile_,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)}

Resolves the profile that actually governs a client: the client's own
[SecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SecurityProfile 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.SecurityProfile') when it states one \(including an explicit
[None](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.None 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\.None') opt\-out\), otherwise the server\-wide default\. A client
therefore opts in or out individually, while a single\-profile deployment sets the default once
and every unprofiled client inherits it\.

```csharp
public static Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile Effective(System.Nullable<Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile> clientProfile, Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile defaultProfile);
```
#### Parameters

###### `clientProfile` [System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Effective(System.Nullable_Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile_,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).clientProfile}

The profile stated on the client, or `null` when unset\.

###### `defaultProfile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Effective(System.Nullable_Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile_,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).defaultProfile}

The server\-wide default profile to fall back to\.

#### Returns
[ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile')

## SecurityProfileRequirements\.For\(ClientInfo, ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)}

Convenience entry point for the validators: resolves the effective profile for a client and
returns its control bundle in one call\.

```csharp
public static Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo client, Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile defaultProfile);
```
#### Parameters

###### `client` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).client}

The client whose effective profile is being resolved\.

###### `defaultProfile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).defaultProfile}

The server\-wide default profile to fall back to\.

#### Returns
[SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements')

## SecurityProfileRequirements\.Resolve\(ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)}

Returns the control bundle a given profile mandates\.

```csharp
public static Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile profile);
```
#### Parameters

###### `profile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).profile}

#### Returns
[SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements')