simba-chain-dpop

• Datadog CI Details
• Datadog Security Scanning

This library provides utilities for creating DPoP Proofs.

A DPoP proof is a JWT that contains a public key that the client will sign the authentication token with. The JWT is signed by the corresponing private key owned by the client.

Three methods are exposed:

1. Create a JWT header object - createHeader
2. Create a JWT payload object that can include a server provided nonce and authentication token - createPayload
3. Create a DPoP JWT signed and base64 URL encoded string - signJwt

The nonce field should be provided if the server has included a DPoP-Nonce HTTP header. This can be sent in successful responses and also on failed responses if the server has changed the nonce, or the client has not included an expected nonce.

The token should be provided as part of requesting access using the token. This is hashed and added to the proof as the ath field.

The output from the signJwt function should be added to the HTTP request as the DPoP HTTP header.

NPM

Grab a gitlab token from here with at least "read_repository, read_registry, read_api" permissions. Set a sensible expiration date.

Run the following:

npm config set //gitlab.com/api/v4/groups/12257889/-/packages/npm/:_authToken <token>