Package rfc
Overview
Package rfc is the root of a module of Go packages that implement IETF RFCs for HTTP APIs and OAuth, one package per RFC, named after it:
- rfc9110 builds 4xx and 5xx statuses that carry the header fields HTTP Semantics requires, such as WWW-Authenticate on a 401, and negotiates media types with Accept.
- rfc9457 builds and reads problem details, the JSON error body.
- rfc6901 implements JSON Pointer, which locates a field in a problem's errors.
- rfc6585 adds 428, 429, 431 and 511.
- rfc9111 builds Cache-Control directives.
- rfc6750 handles Bearer tokens and challenges.
- rfc7617 builds Basic challenges.
- rfc7616 parses and formats Digest fields and computes Digest responses.
- rfc7636 checks PKCE code challenges and verifiers.
- rfc8414 builds and reads OAuth authorization server metadata.
- rfc8707 parses resource indicators.
- rfc9207 checks the iss parameter of authorization responses.
- rfc9068 reads and validates JWT access token claims.
- rfc9728 builds and reads OAuth protected resource metadata.
- rfc6890 reports special-purpose IP addresses, for SSRF checks.
IETF drafts get packages named after the draft, ending in "draft", which track its latest revision until it's published as an RFC:
- oauth21draft implements the OAuth 2.1 authorization and token endpoints' parameters and responses.
- cimddraft checks OAuth Client ID Metadata Documents.
The packages use only the standard library. Each one's directory holds the text of its RFC or draft revision, and its doc comments cite the sections they implement.
This package itself has no API.
Subpackages
| Package | Description |
|---|---|
funnyhaha.technology/rfc/cimddraft | Package cimddraft implements OAuth Client ID Metadata Documents for an authorization server: checking a client identifier that’s a URL, and the metadata document fetched from it. |
funnyhaha.technology/rfc/oauth21draft | Package oauth21draft implements the parts of The OAuth 2.1 Authorization Framework that an authorization server’s endpoints share: reading request parameters, scopes, redirect URI matching, and the success and error responses of the authorization and token endpoints. |
funnyhaha.technology/rfc/rfc6585 | Package rfc6585 builds the status codes added by RFC 6585 (Additional HTTP Status Codes) as rfc9110.Status values, so they work anywhere a status from package rfc9110 does: |
funnyhaha.technology/rfc/rfc6750 | Package rfc6750 implements the parts of RFC 6750 (OAuth 2.0 Bearer Token Usage) that a resource server needs: reading a bearer token from the Authorization header field, and challenging a client that didn’t send a valid one. |
funnyhaha.technology/rfc/rfc6890 | Package rfc6890 reports whether an IP address is in one of the special-purpose address blocks of RFC 6890 (Special-Purpose IP Address Registries): private-use, loopback, link-local, documentation and the rest. |
funnyhaha.technology/rfc/rfc6901 | Package rfc6901 implements JSON Pointer, defined by RFC 6901 (JavaScript Object Notation (JSON) Pointer): a string such as “/profile/color” that identifies a value within a JSON document. |
funnyhaha.technology/rfc/rfc7616 | Package rfc7616 implements HTTP Digest calculations and field syntax. |
funnyhaha.technology/rfc/rfc7617 | Package rfc7617 builds challenges for the Basic authentication scheme, defined by RFC 7617 (The ‘Basic’ HTTP Authentication Scheme): |
funnyhaha.technology/rfc/rfc7636 | Package rfc7636 implements the parts of RFC 7636 (Proof Key for Code Exchange, PKCE) that an authorization server needs: checking the code challenge in an authorization request, and verifying the code verifier in the token request against it. |
funnyhaha.technology/rfc/rfc8414 | Package rfc8414 implements OAuth 2.0 Authorization Server Metadata, from RFC 8414: the JSON document an authorization server publishes at a well-known URL, so clients can find its endpoints and capabilities. |
funnyhaha.technology/rfc/rfc8707 | Package rfc8707 implements resource indicators, from RFC 8707 (Resource Indicators for OAuth 2.0): the “resource” parameter a client sends to say which protected resource it wants a token for, and the invalid_target error an authorization server returns when it won’t issue one. |
funnyhaha.technology/rfc/rfc9068 | Package rfc9068 implements the JWT Profile for OAuth 2.0 Access Tokens, from RFC 9068: the claims an access token carries, and the checks a resource server makes before it accepts one. |
funnyhaha.technology/rfc/rfc9110 | Package rfc9110 builds HTTP error statuses that carry the header fields RFC 9110 (HTTP Semantics) requires of them. |
funnyhaha.technology/rfc/rfc9111 | Package rfc9111 builds Cache-Control response directives, as defined by RFC 9111 (HTTP Caching). |
funnyhaha.technology/rfc/rfc9207 | Package rfc9207 implements the authorization server issuer identification of RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification): the iss parameter in authorization responses, which lets a client that uses several authorization servers detect a mix-up attack. |
funnyhaha.technology/rfc/rfc9457 | Package rfc9457 builds and reads problem details, defined by RFC 9457 (Problem Details for HTTP APIs): a JSON body, with the media type application/problem+json, that explains why a request failed. |
funnyhaha.technology/rfc/rfc9728 | Package rfc9728 implements OAuth 2.0 Protected Resource Metadata, from RFC 9728: the JSON document a resource server publishes at a well-known URL so clients and authorization servers can discover its configuration, and the resource_metadata parameter that points a client to it from a 401. |