#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces')

## RollingHmacNonceService Class

HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\.
Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])`
where `secret` is rotated on a configurable cadence and shared across
server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\.

```csharp
public class RollingHmacNonceService : Abblix.Oidc.Server.Features.Nonces.INonceService
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RollingHmacNonceService

Implements [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')

### Remarks
The bucketed\-secret design avoids any explicit lock or coordination on the
rotation boundary: every instance derives the same bucket index from the
nonce's embedded timestamp, looks up that bucket's secret in the
distributed cache, and either finds it or creates one with last\-write\-wins
semantics\. Per RFC 9449 §11\.3 a brief mismatch during the rotation race
surfaces to the DPoP client as a single retry with a fresh
`DPoP-Nonce` header, which is the protocol's intended recovery path;
other consumers of this service get the analogous one\-retry behaviour
through their own challenge\-response loop\.
### Constructors

## RollingHmacNonceService\(ILogger\<RollingHmacNonceService\>, IDistributedCache, IOptionsMonitor\<OidcOptions\>, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)}

HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\.
Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])`
where `secret` is rotated on a configurable cadence and shared across
server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\.

```csharp
public RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService> logger, Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, Microsoft.Extensions.Options.IOptionsMonitor<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options, System.TimeProvider timeProvider);
```
#### Parameters

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).logger}

###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).cache}

###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options}

###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider}

### Remarks
The bucketed\-secret design avoids any explicit lock or coordination on the
rotation boundary: every instance derives the same bucket index from the
nonce's embedded timestamp, looks up that bucket's secret in the
distributed cache, and either finds it or creates one with last\-write\-wins
semantics\. Per RFC 9449 §11\.3 a brief mismatch during the rotation race
surfaces to the DPoP client as a single retry with a fresh
`DPoP-Nonce` header, which is the protocol's intended recovery path;
other consumers of this service get the analogous one\-retry behaviour
through their own challenge\-response loop\.
### Methods

## RollingHmacNonceService\.IssueAsync\(CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.IssueAsync(System.Threading.CancellationToken)}

Mints a fresh nonce string suitable for the `DPoP-Nonce` response
header\. The returned value is opaque to callers — clients must echo it
verbatim\.

```csharp
public System.Threading.Tasks.Task<string> IssueAsync(System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.IssueAsync(System.Threading.CancellationToken).cancellationToken}

Implements [IssueAsync\(CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.IssueAsync(System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.IssueAsync\(System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')

## RollingHmacNonceService\.ValidateAsync\(string, CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken)}

Verifies that [nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)\.nonce') was issued by this deployment
and is still within the acceptance window\.

```csharp
public System.Threading.Tasks.Task<System.Nullable<Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure>> ValidateAsync(string nonce, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `nonce` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce}

The nonce string echoed by the client in its DPoP
            proof `nonce` claim\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).cancellationToken}

Cancellation token\.

Implements [ValidateAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
`null` when the nonce is acceptable, otherwise a
            [NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure') describing why it is not\.