#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')

## Abblix\.Oidc\.Server\.Features\.DPoP Namespace

| Classes | |
| :--- | :--- |
| [DPoPAlgorithms](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPAlgorithms 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPAlgorithms') | Single source of truth for the DPoP signing\-algorithm whitelist \(RFC 9449 §4\.2, §7\.1\)\. Both the proof\-validator's enforcement \(it rejects proofs whose `alg` header sits outside this set\) and the resource\-server's `WWW-Authenticate: DPoP
            algs="..."` challenge advertisement read from here, so adding a new algorithm \(e\.g\. EdDSA when the JWS layer gains support\) propagates everywhere automatically\. |
| [DPoPNonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator') | Base class for DPoP\-aware endpoint validators that enforce the RFC 9449 §8 nonce challenge\-response loop\. Encapsulates the proof\-claim check, fresh\-nonce issuance, and [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') shaping; concrete validators override [Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.dpopnoncevalidator.lognoncechallengeissued 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued') to attribute the «challenge issued» event to their own endpoint `EventId`\. |
| [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') | The product of a successfully validated DPoP proof: the parsed JWT \(so callers can read claims the validator does not consume itself, e\.g\. `nonce`\), the public\-only JWK extracted from the proof's `jwk` header, its base64url\-encoded RFC 7638 JWK Thumbprint \(the value that goes into `cnf.jkt` on the issued access token and matches against `dpop_jkt`\), the proof\-unique `jti` for downstream replay protection, and the `iat` the proof claims to have been signed at\. |
| [ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError') | Describes why a DPoP proof was rejected\. [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') is a stable token suitable for log filters and metric labels; [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') is a human\-readable hint that MUST NOT contain attacker\-controllable input verbatim, since this string can surface in error responses and operator dashboards\. |
| [ProofErrorReasons](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofErrorReasons') | Stable, machine\-friendly reason tokens that [Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.proofvalidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator') assigns to [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') for log filters and metric labels\. These are the internal fine\-grained failure categories; the OAuth\-protocol\-level error code surfaced to clients is always `invalid_dpop_proof` \(or `use_dpop_nonce` for the nonce\-required path\) regardless of which of these matched\. |

| Interfaces | |
| :--- | :--- |
| [IProofValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator') | Validates a DPoP proof JWT per RFC 9449 §4\.2 / §4\.3 \(structure, signature, claim shape\) but excluding replay\-cache and nonce checks\. Those layered checks land alongside the `jti`\-replay\-cache and DPoP\-Nonce service in a separate slice and build on the [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') returned by a successful validation here\. |