fix: header casing

Author: auer-martin

packages/client/lib/AccessTokenClient.ts

@@ -96,15 +96,15 @@ export class AccessTokenClient {
     const useDpop = createDPoPOpts?.dPoPSigningAlgValuesSupported && createDPoPOpts.dPoPSigningAlgValuesSupported.length > 0;
     let dPoP = useDpop ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL)) : undefined;
 
-    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dPoP } } : undefined);
+    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
 
     let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
     const retryWithNonce = dPoPShouldRetryRequestWithNonce(response);
     if (retryWithNonce.ok && createDPoPOpts) {
       createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
 
       dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL));
-      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dPoP } } : undefined);
+      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
       const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
 
       nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;

packages/client/lib/AccessTokenClientV1_0_11.ts

@@ -100,15 +100,15 @@ export class AccessTokenClientV1_0_11 {
     const useDpop = createDPoPOpts?.dPoPSigningAlgValuesSupported && createDPoPOpts.dPoPSigningAlgValuesSupported.length > 0;
     let dPoP = useDpop ? await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL)) : undefined;
 
-    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dPoP } } : undefined);
+    let response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
 
     let nextDPoPNonce = createDPoPOpts?.jwtPayloadProps.nonce;
     const retryWithNonce = dPoPShouldRetryRequestWithNonce(response);
     if (retryWithNonce.ok && createDPoPOpts) {
       createDPoPOpts.jwtPayloadProps.nonce = retryWithNonce.dpopNonce;
 
       dPoP = await createDPoP(getCreateDPoPOptions(createDPoPOpts, requestTokenURL));
-      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dPoP } } : undefined);
+      response = await this.sendAuthCode(requestTokenURL, accessTokenRequest, dPoP ? { headers: { dpop: dPoP } } : undefined);
       const successDPoPNonce = response.origResponse.headers.get('DPoP-Nonce');
 
       nextDPoPNonce = successDPoPNonce ?? retryWithNonce.dpopNonce;

packages/client/lib/CredentialRequestClient.ts

@@ -129,7 +129,7 @@ export class CredentialRequestClient {
 
     let response = (await post(credentialEndpoint, JSON.stringify(request), {
       bearerToken: requestToken,
-      customHeaders: { ...(dPoP && { dPoP }) },
+      customHeaders: { ...(dPoP && { dpop: dPoP }) },
     })) as OpenIDResponse<CredentialResponse> & {
       access_token: string;
     };
@@ -142,7 +142,7 @@ export class CredentialRequestClient {
 
       response = (await post(credentialEndpoint, JSON.stringify(request), {
         bearerToken: requestToken,
-        customHeaders: { ...(createDPoPOpts && { dPoP }) },
+        customHeaders: { ...(createDPoPOpts && { dpop: dPoP }) },
       })) as OpenIDResponse<CredentialResponse> & {
         access_token: string;
       };

packages/client/lib/CredentialRequestClientV1_0_11.ts

@@ -106,7 +106,7 @@ export class CredentialRequestClientV1_0_11 {
 
       response = (await post(credentialEndpoint, JSON.stringify(request), {
         bearerToken: requestToken,
-        customHeaders: { ...(createDPoPOpts && { dPoP }) },
+        customHeaders: { ...(createDPoPOpts && { dpop: dPoP }) },
       })) as OpenIDResponse<CredentialResponse> & {
         access_token: string;
       };

packages/client/lib/functions/dpopUtil.ts

@@ -16,7 +16,7 @@ export function dPoPShouldRetryRequestWithNonce(response: OpenIDResponse<unknown
 
 export function dPoPShouldRetryResourceRequestWithNonce(response: OpenIDResponse<unknown, unknown>) {
   if (response.errorBody && response.origResponse.status === 401) {
-    const wwwAuthenticateHeader = response.errorBody.headers.get('WWW-Authenticate');
+    const wwwAuthenticateHeader = response.errorBody.headers?.get('WWW-Authenticate');
     if (!wwwAuthenticateHeader?.includes(dpopResourceAuthenticateError)) {
       return { ok: false } as const;
     }