AttestoClient.ResourceServer.Plug (AttestoClient v2.2.0)

Copy Markdown View Source

Authenticate a Plug request with AttestoClient.ResourceServer.

The plug accepts RFC 6750 Bearer presentation and RFC 9449 DPoP presentation, verifies any DPoP proof (including replay and optional nonce checks), computes an optional mTLS certificate thumbprint, verifies the remote issuer's access token, enforces configured scopes, and assigns the claims to the connection.

plug AttestoClient.ResourceServer.Plug,
  server: MyApp.RemoteIssuer,
  required_scopes: ["documents.read"],
  replay_check: &MyApp.DPoPReplay.check_and_record/2,
  resource_metadata: "https://api.example/.well-known/oauth-protected-resource"

Options

  • :server (required) - a AttestoClient.ResourceServer server or a zero-arity function returning one.
  • :required_scopes - exact OAuth scope tokens required by this route.
  • :allowed_subjects / :allowed_client_ids - optional exact token-acceptance allowlists for this route.
  • :max_token_age_seconds / :max_token_lifetime_seconds - optional token-age policy forwarded to the verifier.
  • :claims_key - the conn.assigns key (default :attesto_claims).
  • :replay_check - required for every DPoP request.
  • :nonce_check / :nonce_issue - RFC 9449 server nonce callbacks.
  • :dpop_max_age_seconds - maximum DPoP proof age passed to Attesto.
  • :cert_der - callback returning the authenticated client certificate's DER bytes or nil; the TLS terminator remains responsible for trust.
  • :htu - callback returning the externally visible request URI without query or fragment.
  • :resource_metadata, :send_error, :www_authenticate, :no_store - forwarded to Attesto's OAuth error transport.

DPoP-bound and mTLS-bound tokens fail closed when the matching current request evidence is absent. Query-string and form-body access tokens are intentionally not accepted.