feat(sep-1932): DPoP error codes (stacked on #527) - #528

Stacked on #527 -> #395 (PieterKas/conformance:dpop-server, head dd9fd77). This branch contains those commits plus 9771ecb. Rebase onto #395 once #527 merges.

The new commit (9771ecb) is the only one to review here.

What each check asserts

#395 checks that a malformed proof is rejected with a DPoP challenge. It does not check which error the server reports. #527 tightens the Bearer-scheme probe so only a 401 with a Bearer or DPoP challenge counts.

sep-1932-server-error-code

RFC 9449 §7.1, graded SHOULD from "An error parameter ([RFC6750], Section 3) SHOULD be included to indicate the reason why the request was declined, if the request included an access token but failed authentication. The error parameter values described in [RFC6750], Section 3.1 are suitable, as are any appropriate values defined by extension. The value use_dpop_nonce can be used as described in Section 9 to signal that a nonce is needed in the DPoP proof of a subsequent request(s). Additionally, invalid_dpop_proof is used to indicate that the DPoP proof itself was deemed invalid based on the criteria of Section 4.3."

One check. The error auth-param is read from the DPoP challenge (the header may carry several), quoted or unquoted. Mismatches are listed in details. Absent or unexpected is WARNING. SUCCESS otherwise. Gated on the positive baseline. Existing MUST checks do not look at the code, so their status is unchanged.

• Proof defects (tampered signature, missing claims, wrong typ, htm/htu mismatch, private key in jwk, stale or future iat, alg none or symmetric, duplicate header, malformed JWT, missing or wrong ath): invalid_dpop_proof
• wrong-audience: invalid_token
• cnf-jkt-mismatch and bearer-scheme: either

DPOP_ERROR_CODE_OVERRIDE=invalid_request returns that code on every 401. The check reports WARNING. The compliant fixture already emits invalid_dpop_proof for proof defects and invalid_token for token defects.

GET is not probed. Revision 2026-07-28 removed the GET stream, and a server that speaks only this revision SHOULD answer GET with 405, so a GET cannot show whether htm was checked. htm stays covered by the existing POST probe (RejectsHtmMismatch, proof htm of GET).

Testing

• DPoP server scenario tests pass (11), including the Bearer fixture from feat(sep-1932): tighten the Bearer-downgrade probe (stacked on #395) #527 and DPOP_ERROR_CODE_OVERRIDE
• eslint + prettier — clean

Made with Cursor