@@ -17,11 +17,11 @@ the client for the token endpoint.
17
17
## Request and response objects
18
18
19
19
20
- All protocol request are modelled as request objects and have a common
21
- base class called * ProtocolRequest* which has properties to set the
20
+ All protocol request are modeled as request objects and have a common
21
+ base class called ` ProtocolRequest ` which has properties to set the
22
22
endpoint address, client ID, client secret, client assertion, and the
23
23
details of how client secrets are transmitted (e.g. authorization header
24
- vs POST body). * ProtocolRequest* derives from * HttpRequestMessage* and
24
+ vs POST body). ` ProtocolRequest ` derives from ` HttpRequestMessage ` and
25
25
thus also allows setting custom headers etc.
26
26
27
27
The following code snippet creates a request for a client credentials
@@ -36,16 +36,16 @@ var request = new ClientCredentialsTokenRequest
36
36
};
37
37
```
38
38
39
- While in theory you could now call * Prepare* (which internally sets the
39
+ While in theory you could now call ` Prepare ` (which internally sets the
40
40
headers, body and address) and send the request via a plain
41
- * HttpClient* , typically there are more parameters with special semantics
41
+ ` HttpClient ` , typically there are more parameters with special semantics
42
42
and encoding required. That's why we provide extension methods to do
43
43
the low level work.
44
44
45
- Equally, a protocol response has a corresponding * ProtocolResponse*
45
+ Equally, a protocol response has a corresponding ` ProtocolResponse `
46
46
implementation that parses the status codes and response content. The
47
47
following code snippet would parse the raw HTTP response from a token
48
- endpoint and turn it into a * TokenResponse* object:
48
+ endpoint and turn it into a ` TokenResponse ` object:
49
49
50
50
``` cs
51
51
var tokenResponse = await ProtocolResponse
@@ -58,12 +58,12 @@ have a look at an example next.
58
58
## Extension methods
59
59
60
60
For each protocol interaction, an extension method for
61
- * HttpMessageInvoker* (that's the base class of * HttpClient* ) exists.
61
+ ` HttpMessageInvoker ` (that's the base class of ` HttpClient ` ) exists.
62
62
The extension methods expect a request object and return a response
63
63
object.
64
64
65
65
It is your responsibility to set up and manage the lifetime of the
66
- * HttpClient* , e.g. manually:
66
+ ` HttpClient ` , e.g. manually:
67
67
68
68
``` cs
69
69
var client = new HttpClient ();
@@ -77,7 +77,7 @@ var response = await client.RequestClientCredentialsTokenAsync(
77
77
});
78
78
```
79
79
80
- You might want to use other techniques to obtain an * HttpClient* , e.g.
80
+ You might want to use other techniques to obtain an ` HttpClient ` , e.g.
81
81
via the HTTP client factory:
82
82
83
83
``` cs
@@ -96,7 +96,7 @@ All other endpoint client follow the same design.
96
96
97
97
::: note
98
98
Some client libraries also include a stateful client object (e.g.
99
- * TokenClient* and * IntrospectionClient* ). See the corresponding section
99
+ ` TokenClient ` and ` IntrospectionClient ` ). See the corresponding section
100
100
to find out more.
101
101
:::
102
102
@@ -108,9 +108,9 @@ HTTP Basic authentication encoding issues.
108
108
:::
109
109
110
110
111
- Any request type implementing * ProtocolRequest* has the ability to configure
111
+ Any request type implementing ` ProtocolRequest ` has the ability to configure
112
112
the client credential style, which specifies how the client will transmit the client ID and secret.
113
- * ClientCredentialStyle* options include * PostBody* and the default value of * AuthorizationHeader* .
113
+ ` ClientCredentialStyle ` options include ` PostBody ` and the default value of ` AuthorizationHeader ` .
114
114
115
115
``` cs
116
116
var client = HttpClientFactory .CreateClient (" my_named_token_client" );
@@ -131,7 +131,7 @@ specification version you are targeting. When using IdentityServer, both header
131
131
are supported and _ "it just works"_ .
132
132
133
133
[ RFC 6749] ( https://datatracker.ietf.org/doc/rfc6749/ ) , the original OAuth spec, says that support for the basic auth header is mandatory,
134
- and that the POST body is optional. OAuth 2.1 reverses this - now the body is mandatory and the header is optional.
134
+ and that the POST body is optional. OAuth 2.1 reverses this: now the body is mandatory and the header is optional.
135
135
136
136
In the previous OAuth specification version, the header caused bugs and interoperability problems. To follow
137
137
both RFC 6749 and RFC 2617 (which is where basic auth headers are specified), you have to form url encode the client id and client secret,
@@ -145,22 +145,22 @@ References:
145
145
- [ RFC 2617 section 2] ( https://www.rfc-editor.org/rfc/rfc2617#section-2 )
146
146
- [ OAuth 2.1 Draft] ( https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/ )
147
147
148
- Here is a complete list of * ProtocolRequest* implementors that expose the * ClientCredentialStyle* option:
149
-
150
- - * Duende.IdentityModel.Client.AuthorizationCodeTokenRequest*
151
- - * Duende.IdentityModel.Client.BackchannelAuthenticationRequest*
152
- - * Duende.IdentityModel.Client.BackchannelAuthenticationTokenRequest*
153
- - * Duende.IdentityModel.Client.ClientCredentialsTokenRequest*
154
- - * Duende.IdentityModel.Client.DeviceAuthorizationRequest*
155
- - * Duende.IdentityModel.Client.DeviceTokenRequest*
156
- - * Duende.IdentityModel.Client.DiscoveryDocumentRequest*
157
- - * Duende.IdentityModel.Client.DynamicClientRegistrationRequest*
158
- - * Duende.IdentityModel.Client.JsonWebKeySetRequest*
159
- - * Duende.IdentityModel.Client.PasswordTokenRequest*
160
- - * Duende.IdentityModel.Client.PushedAuthorizationRequest*
161
- - * Duende.IdentityModel.Client.RefreshTokenRequest*
162
- - * Duende.IdentityModel.Client.TokenExchangeTokenRequest*
163
- - * Duende.IdentityModel.Client.TokenIntrospectionRequest*
164
- - * Duende.IdentityModel.Client.TokenRequest*
165
- - * Duende.IdentityModel.Client.TokenRevocationRequest*
166
- - * Duende.IdentityModel.Client.UserInfoRequest*
148
+ Here is a complete list of ` ProtocolRequest ` implementors that expose the ` ClientCredentialStyle ` option:
149
+
150
+ - ` Duende.IdentityModel.Client.AuthorizationCodeTokenRequest `
151
+ - ` Duende.IdentityModel.Client.BackchannelAuthenticationRequest `
152
+ - ` Duende.IdentityModel.Client.BackchannelAuthenticationTokenRequest `
153
+ - ` Duende.IdentityModel.Client.ClientCredentialsTokenRequest `
154
+ - ` Duende.IdentityModel.Client.DeviceAuthorizationRequest `
155
+ - ` Duende.IdentityModel.Client.DeviceTokenRequest `
156
+ - ` Duende.IdentityModel.Client.DiscoveryDocumentRequest `
157
+ - ` Duende.IdentityModel.Client.DynamicClientRegistrationRequest `
158
+ - ` Duende.IdentityModel.Client.JsonWebKeySetRequest `
159
+ - ` Duende.IdentityModel.Client.PasswordTokenRequest `
160
+ - ` Duende.IdentityModel.Client.PushedAuthorizationRequest `
161
+ - ` Duende.IdentityModel.Client.RefreshTokenRequest `
162
+ - ` Duende.IdentityModel.Client.TokenExchangeTokenRequest `
163
+ - ` Duende.IdentityModel.Client.TokenIntrospectionRequest `
164
+ - ` Duende.IdentityModel.Client.TokenRequest `
165
+ - ` Duende.IdentityModel.Client.TokenRevocationRequest `
166
+ - ` Duende.IdentityModel.Client.UserInfoRequest `
0 commit comments