Improve error description in case invalid DPoP nonce is used

[matthieusieben]

The following issue showed that the error message can contain Authorization server requires nonce in DPoP proof when a nonce is actually present in the proof.

This change uses a distinct error message in that particular case.

[bnewbold]

can't speak to the TypeScript, but error messages look good and are an improvement!

[PIPOGit]

Now:

Te response received (with the access token) when calling the "/token" endpoint:

{
  "access_token": "eyJ0eXAiOiJhdCtqd3QiLCJhbGciOiJFUzI1NksifQ.eyJhdWQiOiJkaWQ6d2ViOnZlbHZldGZvb3QudXMtZWFzdC5ob3N0LmJza3kubmV0d29yayIsImlhdCI6MTczNzU3MTMxMywiZXhwIjoxNzM3NTc0OTEzLCJzdWIiOiJkaWQ6cGxjOnRqYzI3YWplNHV3eHR3NWFiNnd3bTRrbSIsImp0aSI6InRvay0zZTlhNmE0ZWQwNjhlOGU1YmRhYTgzY2IwOWFmY2I4NCIsImNuZiI6eyJqa3QiOiJZTEVuRTRXdE5GNlNBcmRNUXhPM2FJSWZXc09vWFZSZHpzOEhYY3FfQ2o0In0sImNsaWVudF9pZCI6Imh0dHBzOi8vbWFkcmlsZW55ZXIubmVvY2l0aWVzLm9yZy9ic2t5L29hdXRoL2NsaWVudC1tZXRhZGF0YS5qc29uIiwic2NvcGUiOiJhdHByb3RvIHRyYW5zaXRpb246Z2VuZXJpYyIsImlzcyI6Imh0dHBzOi8vYnNreS5zb2NpYWwifQ.ok_LHUkgQ2Jt-S6uj4U7MiYabQ5JczINJFUTQ65xAV0GcMHu6_UegWik43VOEwsdToZchjS6TD05PDW-Vxf6hQ",
  "token_type": "DPoP",
  "refresh_token": "ref-77412b68b8852bc65dd4c48b3911734b3e955ba6ca98aec67fc81e1c974a3ca6",
  "scope": "atproto transition:generic",
  "expires_in": 3599,
  "sub": "did:plc:tjc27aje4uwxtw5ab6wwm4km"
}

I'm trying to call: "https://velvetfoot.us-east.host.bsky.network/xrpc/app.bsky.notification.listNotifications", as per documentation, using that access_token.

Generated a dpopProof:

{
    "typ": "dpop+jwt",
    "alg": "ES256",
    "jwk": {
        "crv": "P-256",
        "kty": "EC",
        "x": "G8VnQ3hmrk_cJtVk93W_Sy3Y-vzHs6Ii3qmgmwVdovU",
        "y": "sx0tHsEZaBLtuGzZGQ-ZcTXJyfOXxW3Ykcla82qpasY"
    }
}.{
    "iss": "https://madrilenyer.neocities.org/bsky/oauth/client-metadata.json",
    "ath": "5iaT8hpes9diUngqk5F0uhVFWOLUQY_bdVrCHaSRP2c",
    "jti": "68a45069-66d4-4e9e-9c10-bb7589c593bd",
    "htm": "GET",
    "htu": "https://velvetfoot.us-east.host.bsky.network/xrpc/app.bsky.notification.listNotifications",
    "iat": 1737571314,
    "nonce": "80CARO2tI2jySbUsGfIOK_61Z4AtPIodeDGUM-i9syw"
}.ixZlPLhW0QrgZlNmHQisfn6EP7F8ygsEY03VmNzy5z20xQJpZcNJdR0pMYEo6yj5UnIoqkyS9LNJcoLLxWulIA

and performed a ([GET]) call to the endPoint with this headers:

{
    "Authorization": "DPoP eyJ0eXAiOiJhdCtqd3QiLCJhbGciOiJFUzI1NksifQ.eyJhdWQiOiJkaWQ6d2ViOnZlbHZldGZvb3QudXMtZWFzdC5ob3N0LmJza3kubmV0d29yayIsImlhdCI6MTczNzU3MTMxMywiZXhwIjoxNzM3NTc0OTEzLCJzdWIiOiJkaWQ6cGxjOnRqYzI3YWplNHV3eHR3NWFiNnd3bTRrbSIsImp0aSI6InRvay0zZTlhNmE0ZWQwNjhlOGU1YmRhYTgzY2IwOWFmY2I4NCIsImNuZiI6eyJqa3QiOiJZTEVuRTRXdE5GNlNBcmRNUXhPM2FJSWZXc09vWFZSZHpzOEhYY3FfQ2o0In0sImNsaWVudF9pZCI6Imh0dHBzOi8vbWFkcmlsZW55ZXIubmVvY2l0aWVzLm9yZy9ic2t5L29hdXRoL2NsaWVudC1tZXRhZGF0YS5qc29uIiwic2NvcGUiOiJhdHByb3RvIHRyYW5zaXRpb246Z2VuZXJpYyIsImlzcyI6Imh0dHBzOi8vYnNreS5zb2NpYWwifQ.ok_LHUkgQ2Jt-S6uj4U7MiYabQ5JczINJFUTQ65xAV0GcMHu6_UegWik43VOEwsdToZchjS6TD05PDW-Vxf6hQ",
    "DPoP": "eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7ImNydiI6IlAtMjU2Iiwia3R5IjoiRUMiLCJ4IjoiRzhWblEzaG1ya19jSnRWazkzV19TeTNZLXZ6SHM2SWkzcW1nbXdWZG92VSIsInkiOiJzeDB0SHNFWmFCTHR1R3paR1EtWmNUWEp5Zk9YeFczWWtjbGE4MnFwYXNZIn19.eyJpc3MiOiJodHRwczovL21hZHJpbGVueWVyLm5lb2NpdGllcy5vcmcvYnNreS9vYXV0aC9jbGllbnQtbWV0YWRhdGEuanNvbiIsImF0aCI6IjVpYVQ4aHBlczlkaVVuZ3FrNUYwdWhWRldPTFVRWV9iZFZyQ0hhU1JQMmMiLCJqdGkiOiI2OGE0NTA2OS02NmQ0LTRlOWUtOWMxMC1iYjc1ODljNTkzYmQiLCJodG0iOiJHRVQiLCJodHUiOiJodHRwczovL3ZlbHZldGZvb3QudXMtZWFzdC5ob3N0LmJza3kubmV0d29yay94cnBjL2FwcC5ic2t5Lm5vdGlmaWNhdGlvbi5saXN0Tm90aWZpY2F0aW9ucyIsImlhdCI6MTczNzU3MTMxNCwibm9uY2UiOiI4MENBUk8ydEkyanlTYlVzR2ZJT0tfNjFaNEF0UElvZGVER1VNLWk5c3l3In0.ixZlPLhW0QrgZlNmHQisfn6EP7F8ygsEY03VmNzy5z20xQJpZcNJdR0pMYEo6yj5UnIoqkyS9LNJcoLLxWulIA",
    "Accept": "application/json",
    "DPoP-Nonce": "80CARO2tI2jySbUsGfIOK_61Z4AtPIodeDGUM-i9syw"
  }

Response:

{
  "bodyUsed": false,
  "ok": false,
  "redirected": false,
  "status": 401,
  "statusText": "",
  "type": "cors",
  "url": "https://velvetfoot.us-east.host.bsky.network/xrpc/app.bsky.notification.listNotifications",
  "headers": {
    "cache-control": "private",
    "content-length": "88",
    "content-type": "application/json; charset=utf-8",
    "dpop-nonce": "u4Tq9bCQT1PNY1k4UuFy24FRb13MUfB9F7FOnyjNRWU",
    "www-authenticate": "DPoP algs=\"RS256 RS384 RS512 PS256 PS384 PS512 ES256 ES256K ES384 ES512\", error=\"use_dpop_nonce\", error_description=\"Authorization server requires nonce in DPoP proof\""
  }
}

ERROR Cause: {
  "status": 401,
  "statusText": "",
  "payload": {
    "error": "use_dpop_nonce",
    "message": "Authorization server requires nonce in DPoP proof"
  }
}

Doubts:

• What's happening? What is missing?
• Is there any field missing in the DPoP header/payload?
• Is correct the URL?
• Any of the values is wrong?
• Which error should I expect to receive?

Sorry for the comment, but...

Thanks for all in advance! ;^)