DPoP Authorization Code Binding For PAR Requests

[PasinduLakshan99]

Purpose

This PR extends the functionality of DPoPEventHandler class to handle events of type PRE_HANDLE_PAR_REQUEST.

Approach

If a DPoP headers is present in a PAR request, DPoPEventHandler will validate the header and if the validation failed,the request will be rejected. Uppon successful validation, the event handler will check for the presence of dpop_jkt request parameter in the PAR request.

• If dpop_jkt request parameter is also present in the PAR request, the JWK thumbprint of the DPoP header will be compared with value of that parameter and if the comparison failed, the request will be rejected.
• Alternatively, if the dpop_jkt request parameter is absent in the request, the thumbprint value derived from the validated DPoP proof header will be appended to the request parameter set with the key dpop_jkt. This addition ensures the continuation of the authorization code binding mechanism as if the dpop_jkt parameter had been initially included in the request.

[Thumimku]

LGTM