From 07024a67f9c07fded50bef7fdce1dd66f5bb1099 Mon Sep 17 00:00:00 2001 From: Hailey Date: Sun, 22 Jun 2025 13:45:31 -0700 Subject: [PATCH] fix: move setting of next nonce above errors --- server/server.go | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/server/server.go b/server/server.go index 4d5deab..381e16f 100644 --- a/server/server.go +++ b/server/server.go @@ -401,6 +401,12 @@ func (s *Server) handleOauthSessionMiddleware(next echo.HandlerFunc) echo.Handle accessToken := pts[1] + nonce := s.oauthProvider.NextNonce() + if nonce != "" { + e.Response().Header().Set("DPoP-Nonce", nonce) + e.Response().Header().Add("access-control-expose-headers", "DPoP-Nonce") + } + proof, err := s.oauthProvider.DpopManager.CheckProof(e.Request().Method, "https://"+s.config.Hostname+e.Request().URL.String(), e.Request().Header, to.StringPtr(accessToken)) if err != nil { s.logger.Error("invalid dpop proof", "error", err) @@ -432,12 +438,6 @@ func (s *Server) handleOauthSessionMiddleware(next echo.HandlerFunc) echo.Handle return helpers.ServerError(e, nil) } - nonce := s.oauthProvider.NextNonce() - if nonce != "" { - e.Response().Header().Set("DPoP-Nonce", nonce) - e.Response().Header().Add("access-control-expose-headers", "DPoP-Nonce") - } - e.Set("repo", repo) e.Set("did", repo.Repo.Did) e.Set("token", accessToken) -- 2.54.0