chore(auth): DPoP and public fixes

[dmihalcik-virtru]

• expose legacy public key endpoint as public
• DPoP htu should include origin part of url
• clarify error messages for dpop

[mkleene]

Do we gain anything by only allowing some hosts? This seems to make sure that the token is for us. I'd say that the aud parameter is what we want here and this is just another thing that we need to configure.

There might be something that I'm missing about what this buys us, though.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[dmihalcik-virtru]

Do we gain anything by only allowing some hosts? This seems to make sure that the token is for us. I'd say that the aud parameter is what we want here and this is just another thing that we need to configure.

RFC 9449 seems to indicate we should do a full match of the URI, after 'normalization' and removing any fragment or query. The code currently only does a match of the path. A compliant DPoP client will set the HTU to exactly this value, although we should still do normalization of it after receiving it.

https://www.rfc-editor.org/rfc/rfc9449.html#name-checking-dpop-proofs

Anyway I see two solutions:

1. only look at the path. this seems to be a violation of the spec
2. Use the origin header from the request, if present
3. allow the URL or URL root to be passed in as a parameter, of which this is one solution.

I'll look into 2

[dmihalcik-virtru]

Now it checks the htu field of the DPoP token matches the request Origin + Path

[mkleene]

This looks great!