[Bug]: JWK thumbprint includes optional members when calculated

[trew]

Contact Details

No response

Describe the bug

When a DPoP is parsed, the JWK thumbprint should only include required members when calculated. See https://datatracker.ietf.org/doc/html/rfc7638#section-3.2

Related lines of code:

go-dpop/parse.go

Lines 124 to 137 in e3feea2

	// Extract the public key from the proof and hash it.
	// This is done in order to store the public key
	// without the need for extracting and hashing it again.
	jwkHeaderJSON, err := json.Marshal(dpopToken.Header["jwk"])
	if err != nil {
	// keyFunc used with parseWithClaims should ensure that this can not happen but better safe than sorry.
	return nil, errors.Join(ErrInvalidProof, err)
	}
	h := sha256.New()
	_, err = h.Write([]byte(jwkHeaderJSON))
	if err != nil {
	return nil, errors.Join(ErrInvalidProof, err)
	}
	b64URLjwkHash := base64.RawURLEncoding.EncodeToString(h.Sum(nil))

Steps to reproduce the behavior

Create a proof with a JWK containing optional fields, for example:

{
  "crv": "P-256",
  "ext": true,
  "kty": "EC",
  "x": "KDVM3aXrYGUgmKyo0q__DdIDVS0AV139ZTba04SKqFQ",
  "y": "SC-oR4qLdhmwrjr6PjJ7_LfFpC_BSFUT14LnMtgjHPs"
}

In this example, "ext" should be excluded.

OS

No response

Relevant log output

No response

Additional Notes

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[SalladinBalwer]

This is indeed a bug and should be fixed.
I will look at it when I have time unless any one else claims it.