Implement DPoP proofs, verification, and replay protection for OAuth by jviotti · Pull Request #2640 · sourcemeta/core

jviotti · 2026-07-20T21:41:52Z

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

jviotti · 2026-07-20T21:44:08Z

+// RFC 9449 Section 4.3 check 7: the public key MUST NOT contain a private key,
+// whose presence is marked by any private JSON Web Key member (RFC 7518
+// Sections 6.2.2 and 6.3.2, RFC 8037 Section 2, RFC 7518 Section 6.4)
+auto dpop_has_private_material(const JSON &key) -> bool {


TODO: Use hashes?

augmentcode · 2026-07-20T21:44:44Z

🤖 Augment PR Summary

Summary: This PR adds full DPoP (RFC 9449) support to the OAuth core module: proof minting, proof verification, and replay detection.

Changes:

Introduces a new public header/API oauth_dpop.h and exports it via oauth.h
Adds OAuthDPoPProofer to mint DPoP proof JWTs (with per-server nonce tracking)
Adds helpers to build/inspect DPoP bindings: oauth_dpop_confirmation() and oauth_dpop_proof_thumbprint()
Implements server-side verification via oauth_dpop_verify() with RFC-aligned error reporting
Adds an in-memory OAuthDPoPReplayStore for jti replay protection within a time window
Adds nonce syntax validation with oauth_is_valid_dpop_nonce()
Wires new sources into CMake and adds comprehensive unit tests (oauth_dpop_test.cc)

Technical Notes: Verification normalizes the HTTP target URI (scheme/host casing, default port, empty path, userinfo stripping) to ensure equivalent requests compare equal, and uses constant-time comparisons for sensitive equality checks.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 4 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-07-20T21:44:45Z

+
+} // namespace
+
+OAuthDPoPProofer::OAuthDPoPProofer(JWKPrivate key, const JWSAlgorithm algorithm)


src/core/oauth/oauth_dpop.cc:165: OAuthDPoPProofer accepts any JWSAlgorithm, but RFC 9449 requires proofs be signed with an asymmetric algorithm; right now the proofer can mint HS* proofs that oauth_dpop_verify() will always reject. Consider failing fast (constructor or proof()) when !dpop_is_asymmetric(algorithm) to avoid producing invalid DPoP proofs.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-07-20T21:44:45Z

+  return true;
+}
+
+auto OAuthDPoPProofer::observe(const std::string_view server,


src/core/oauth/oauth_dpop.cc:226: observe() stores and later echoes whatever nonce is provided; since oauth_is_valid_dpop_nonce() exists and RFC 9449 recommends validating nonces before echoing them, accepting invalid values could poison future proofs. Consider validating/rejecting nonces here (or clearly documenting that callers must validate before calling observe()).

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-07-20T21:44:45Z

+    return std::nullopt;
+  }
+
+  const auto *key{header.try_at("jwk"sv, HASH_JWK)};


src/core/oauth/oauth_dpop.cc:254: oauth_dpop_proof_thumbprint() will compute a thumbprint even if the embedded jwk contains private material (e.g. a d member), even though such a proof should fail RFC 9449 check 7. Consider rejecting keys with private members (similar to dpop_has_private_material) so callers don’t accidentally bind/accept invalid proofs.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-07-20T21:44:45Z

+  return true;
+}
+
+auto OAuthDPoPReplayStore::size(


src/core/oauth/oauth_dpop.cc:435: OAuthDPoPReplayStore::size() is documented as returning the count after pruning expired entries, but it only counts expiry > now and doesn’t erase expired entries (pruning only happens in check_and_insert). This can keep entries_ growing if callers query size() without inserts; consider pruning here or adjusting the API docs.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

jviotti · 2026-07-20T21:46:44Z

+// RFC 9449 Section 4.2: the DPoP algorithm MUST NOT be a symmetric one, so the
+// message authentication code algorithms are the ones to exclude
+auto dpop_is_asymmetric(const JWSAlgorithm algorithm) noexcept -> bool {
+  switch (algorithm) {


TODO: This belongs probably to the JOSE module?

jviotti · 2026-07-20T21:46:48Z

+
+// RFC 7515 Section 4.1.1: the "alg" header value each algorithm serializes to
+auto dpop_algorithm_name(const JWSAlgorithm algorithm) -> std::string_view {
+  switch (algorithm) {


TODO: This belongs probably to the JOSE module?

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions

Benchmark (macos/llvm)

Details

Benchmark suite	Current: `54b2d14`	Previous: `1c2c0f1`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`2.297981602962487` ns/iter	`2.35786216258816` ns/iter	`0.97`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`1.9569679198264294` ns/iter	`2.380802401549196` ns/iter	`0.82`
`Regex_Period_Asterisk`	`1.8732699927551537` ns/iter	`2.5623889324653404` ns/iter	`0.73`
`Regex_Group_Period_Asterisk_Group`	`1.81728520201171` ns/iter	`2.287949390975727` ns/iter	`0.79`
`Regex_Period_Plus`	`2.2192684790908737` ns/iter	`2.9767584122790103` ns/iter	`0.75`
`Regex_Period`	`2.2180668889728867` ns/iter	`2.9492865154053725` ns/iter	`0.75`
`Regex_Caret_Period_Plus_Dollar`	`2.1689213578535615` ns/iter	`3.125407791549456` ns/iter	`0.69`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`2.1899029120981464` ns/iter	`2.7943063627860862` ns/iter	`0.78`
`Regex_Caret_Period_Asterisk_Dollar`	`1.8765291844552956` ns/iter	`2.2229963739549623` ns/iter	`0.84`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`1.8174988583166256` ns/iter	`2.368084974986094` ns/iter	`0.77`
`Regex_Caret_X_Hyphen`	`6.861176478629744` ns/iter	`8.465211666878732` ns/iter	`0.81`
`Regex_Period_Md_Dollar`	`18.682934000849706` ns/iter	`25.03163698689652` ns/iter	`0.75`
`Regex_Caret_Slash_Period_Asterisk`	`6.0224120505202885` ns/iter	`7.736421027783621` ns/iter	`0.78`
`Regex_Caret_Period_Range_Dollar`	`2.4023483376514196` ns/iter	`2.8544417189161932` ns/iter	`0.84`
`Regex_Nested_Backtrack`	`27.77352599374844` ns/iter	`43.31923051626222` ns/iter	`0.64`
`JSON_Array_Of_Objects_Unique`	`394.3030881410444` ns/iter	`503.14938032433116` ns/iter	`0.78`
`JSON_Parse_1`	`7761.132127923082` ns/iter	`8474.079394140383` ns/iter	`0.92`
`JSON_Parse_Real`	`7274.1076705507185` ns/iter	`8075.44508490696` ns/iter	`0.90`
`JSON_Parse_Decimal`	`9350.806848049622` ns/iter	`11904.746590068773` ns/iter	`0.79`
`JSON_Parse_Schema_ISO_Language`	`4378494.22891611` ns/iter	`4865768.420289817` ns/iter	`0.90`
`JSON_Parse_Integer`	`5008.870410001691` ns/iter	`5916.813329999968` ns/iter	`0.85`
`JSON_Parse_String_NonSSO_Plain`	`7951.350891128919` ns/iter	`10081.106695291932` ns/iter	`0.79`
`JSON_Parse_String_SSO_Plain`	`3043.2258671700642` ns/iter	`3417.7888495892707` ns/iter	`0.89`
`JSON_Parse_String_Escape_Heavy`	`22978.334963646677` ns/iter	`29281.971398889786` ns/iter	`0.78`
`JSON_Parse_Object_Short_Keys`	`9309.069552578136` ns/iter	`9604.44980393724` ns/iter	`0.97`
`JSON_Parse_Object_Scalar_Properties`	`5936.4460917917195` ns/iter	`5985.35189452567` ns/iter	`0.99`
`JSON_Parse_Object_Array_Properties`	`8889.046612046706` ns/iter	`9243.84326125066` ns/iter	`0.96`
`JSON_Parse_Object_Object_Properties`	`7911.782308353979` ns/iter	`9741.878308713645` ns/iter	`0.81`
`JSON_Parse_Nested_Containers`	`63274.79880216533` ns/iter	`74194.02343440037` ns/iter	`0.85`
`JSON_From_String_Copy`	`24.90467591735285` ns/iter	`34.73485491949724` ns/iter	`0.72`
`JSON_From_String_Temporary`	`20.91182430328112` ns/iter	`24.47701006045776` ns/iter	`0.85`
`JSON_Number_To_Double`	`35.789921229149606` ns/iter	`41.02713101256642` ns/iter	`0.87`
`JSON_Object_At_Last_Key/8`	`4.382745615677649` ns/iter	`5.076207281007111` ns/iter	`0.86`
`JSON_Object_At_Last_Key/32`	`13.853868126471978` ns/iter	`15.01960377569276` ns/iter	`0.92`
`JSON_Object_At_Last_Key/128`	`59.13352569432524` ns/iter	`66.49863890732249` ns/iter	`0.89`
`JSON_Object_At_Last_Key/512`	`201.65018487380337` ns/iter	`291.350042026764` ns/iter	`0.69`
`JSON_Fast_Hash_Helm_Chart_Lock`	`61.74183086004182` ns/iter	`79.97959001121164` ns/iter	`0.77`
`JSON_Equality_Helm_Chart_Lock`	`156.27190646554388` ns/iter	`193.6862760568845` ns/iter	`0.81`
`JSON_Divisible_By_Decimal`	`220.61503470385216` ns/iter	`226.10229872251983` ns/iter	`0.98`
`JSON_String_Equal/10`	`8.361845747426184` ns/iter	`8.064574001987426` ns/iter	`1.04`
`JSON_String_Equal/100`	`7.501248732984884` ns/iter	`8.416080805944489` ns/iter	`0.89`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.36122323790875405` ns/iter	`0.38781508681969007` ns/iter	`0.93`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`3.697214854489189` ns/iter	`4.458957924530574` ns/iter	`0.83`
`JSON_String_Fast_Hash/10`	`2.567719069613897` ns/iter	`2.742852434952748` ns/iter	`0.94`
`JSON_String_Fast_Hash/100`	`2.181242725902061` ns/iter	`2.746911020828241` ns/iter	`0.79`
`JSON_String_Key_Hash/10`	`1.8264602855718175` ns/iter	`2.2517110179549458` ns/iter	`0.81`
`JSON_String_Key_Hash/100`	`2.356030568675422` ns/iter	`3.1091970895168637` ns/iter	`0.76`
`JSON_Object_Defines_Miss_Same_Length`	`2.858398605213141` ns/iter	`3.4584777949405545` ns/iter	`0.83`
`JSON_Object_Defines_Miss_Too_Small`	`2.8578828819553426` ns/iter	`3.273996419190332` ns/iter	`0.87`
`JSON_Object_Defines_Miss_Too_Large`	`3.032197334523522` ns/iter	`3.5176294896677756` ns/iter	`0.86`
`Pointer_Object_Traverse`	`30.491720795142268` ns/iter	`28.51931219917467` ns/iter	`1.07`
`Pointer_Object_Try_Traverse`	`28.65352837097352` ns/iter	`30.122347365825632` ns/iter	`0.95`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`211.53648179396686` ns/iter	`216.436855507281` ns/iter	`0.98`
`Pointer_Walker_Schema_ISO_Language`	`2920741.877119326` ns/iter	`3540999.8019321687` ns/iter	`0.82`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1343559.1017273099` ns/iter	`1700413.4481236967` ns/iter	`0.79`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1117439.2503961092` ns/iter	`1363604.1666667087` ns/iter	`0.82`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`378.7882096154099` ns/iter	`488.4530912303491` ns/iter	`0.78`
`JSONPath_Descendant_Filter_Nested`	`1449.8212547817543` ns/iter	`1524.4429176817114` ns/iter	`0.95`
`URITemplateRouter_Create`	`26866.351104514055` ns/iter	`29816.045481825964` ns/iter	`0.90`
`URITemplateRouter_Match`	`192.91746879589573` ns/iter	`185.4536036733332` ns/iter	`1.04`
`URITemplateRouter_Match_BasePath`	`219.1831159100531` ns/iter	`242.37487999360138` ns/iter	`0.90`
`URITemplateRouterView_Restore`	`15526.353855157364` ns/iter	`16102.299957996674` ns/iter	`0.96`
`URITemplateRouterView_Match`	`168.3717609151318` ns/iter	`179.4219763467766` ns/iter	`0.94`
`URITemplateRouterView_Match_BasePath`	`164.44617809546287` ns/iter	`201.07175570313083` ns/iter	`0.82`
`URITemplateRouterView_Arguments`	`583.5142730533202` ns/iter	`671.1885321532578` ns/iter	`0.87`
`JSONL_Parse_Large`	`11014774.316667322` ns/iter	`15677150.186048111` ns/iter	`0.70`
`JSONL_Parse_Large_GZIP`	`12095952.473684616` ns/iter	`14115609.119046656` ns/iter	`0.86`
`JSONLD_Catalog_Annotation_List_Populate`	`965294.7183097458` ns/iter	`1331750.7987219945` ns/iter	`0.72`
`JSONLD_Catalog_Materialize`	`5104768.6911762385` ns/iter	`7352088.271186288` ns/iter	`0.69`
`HTML_Build_Table_100000`	`39141592.55555205` ns/iter	`53434236.08332879` ns/iter	`0.73`
`HTML_Render_Table_100000`	`1784245.0846151572` ns/iter	`2382350.9534048913` ns/iter	`0.75`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`28472885.000001043` ns/iter	`38686877.15789507` ns/iter	`0.74`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`3498565.09452723` ns/iter	`5168816.485293933` ns/iter	`0.68`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`1793499.0369517321` ns/iter	`1944445.0567821595` ns/iter	`0.92`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`361741.9467699683` ns/iter	`343775.4490603259` ns/iter	`1.05`
`JOSE_VerifySignature_RS256`	`23895.15412138512` ns/iter	`30270.296989132174` ns/iter	`0.79`
`JOSE_VerifySignature_ES512`	`1195389.8803988092` ns/iter	`1434660.9195401394` ns/iter	`0.83`

This comment was automatically generated by workflow using github-action-benchmark.

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions

Benchmark (linux/llvm)

Details

Benchmark suite	Current: `a79d346`	Previous: `1c2c0f1`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`2.4917321828889443` ns/iter	`2.520738496978584` ns/iter	`0.99`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`2.193113436582532` ns/iter	`2.2175201556945723` ns/iter	`0.99`
`Regex_Period_Asterisk`	`2.196103753338298` ns/iter	`2.205075539285451` ns/iter	`1.00`
`Regex_Group_Period_Asterisk_Group`	`2.4960472909625535` ns/iter	`2.5272053424364227` ns/iter	`0.99`
`Regex_Period_Plus`	`3.1200506489312403` ns/iter	`3.1272648853156` ns/iter	`1.00`
`Regex_Period`	`2.803975993935269` ns/iter	`2.814246491641432` ns/iter	`1.00`
`Regex_Caret_Period_Plus_Dollar`	`2.8034890614925563` ns/iter	`2.8171323451606827` ns/iter	`1.00`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`3.114328907767681` ns/iter	`3.115704523577877` ns/iter	`1.00`
`Regex_Caret_Period_Asterisk_Dollar`	`2.8272622383846064` ns/iter	`3.733952278928808` ns/iter	`0.76`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`2.2324284176773097` ns/iter	`3.4234991878680185` ns/iter	`0.65`
`Regex_Caret_X_Hyphen`	`5.622809801952084` ns/iter	`6.540447664706389` ns/iter	`0.86`
`Regex_Period_Md_Dollar`	`29.341998868696866` ns/iter	`28.545744248134266` ns/iter	`1.03`
`Regex_Caret_Slash_Period_Asterisk`	`6.230812471040772` ns/iter	`6.223125504991132` ns/iter	`1.00`
`Regex_Caret_Period_Range_Dollar`	`4.354987494326341` ns/iter	`4.360585733425543` ns/iter	`1.00`
`Regex_Nested_Backtrack`	`38.9894121034024` ns/iter	`39.03166151338046` ns/iter	`1.00`
`JSON_Array_Of_Objects_Unique`	`392.75698928507444` ns/iter	`397.0865942952036` ns/iter	`0.99`
`JSON_Parse_1`	`4837.618076345633` ns/iter	`4864.634537484209` ns/iter	`0.99`
`JSON_Parse_Real`	`5338.979701992038` ns/iter	`5491.6151876726335` ns/iter	`0.97`
`JSON_Parse_Decimal`	`7582.261551325607` ns/iter	`7568.910113461747` ns/iter	`1.00`
`JSON_Parse_Schema_ISO_Language`	`3510088.2400001865` ns/iter	`3480308.1044777115` ns/iter	`1.01`
`JSON_Parse_Integer`	`3632.540170816008` ns/iter	`3632.635128679152` ns/iter	`1.00`
`JSON_Parse_String_NonSSO_Plain`	`5020.536345973605` ns/iter	`5226.206583242651` ns/iter	`0.96`
`JSON_Parse_String_SSO_Plain`	`2741.7151616824335` ns/iter	`2776.517396251063` ns/iter	`0.99`
`JSON_Parse_String_Escape_Heavy`	`14638.443703477324` ns/iter	`14679.575713255406` ns/iter	`1.00`
`JSON_Parse_Object_Short_Keys`	`10513.908530597364` ns/iter	`11403.818358069368` ns/iter	`0.92`
`JSON_Parse_Object_Scalar_Properties`	`4093.7699546899144` ns/iter	`4318.340125541919` ns/iter	`0.95`
`JSON_Parse_Object_Array_Properties`	`5611.677027070119` ns/iter	`5714.799310729664` ns/iter	`0.98`
`JSON_Parse_Object_Object_Properties`	`5503.729909099979` ns/iter	`5534.534543181721` ns/iter	`0.99`
`JSON_Parse_Nested_Containers`	`44734.9927951064` ns/iter	`45461.44458981651` ns/iter	`0.98`
`JSON_From_String_Copy`	`20.7020520511632` ns/iter	`22.93746599670268` ns/iter	`0.90`
`JSON_From_String_Temporary`	`18.089785529945637` ns/iter	`19.266035629793496` ns/iter	`0.94`
`JSON_Number_To_Double`	`23.133826908800327` ns/iter	`23.29034804888776` ns/iter	`0.99`
`JSON_Object_At_Last_Key/8`	`3.9287882364398525` ns/iter	`3.8770518169316293` ns/iter	`1.01`
`JSON_Object_At_Last_Key/32`	`12.388689204024631` ns/iter	`12.325050961445902` ns/iter	`1.01`
`JSON_Object_At_Last_Key/128`	`49.3914989519984` ns/iter	`49.07459901466207` ns/iter	`1.01`
`JSON_Object_At_Last_Key/512`	`393.30742376864794` ns/iter	`393.2833377680529` ns/iter	`1.00`
`JSON_Fast_Hash_Helm_Chart_Lock`	`60.64027625512194` ns/iter	`58.20546778873356` ns/iter	`1.04`
`JSON_Equality_Helm_Chart_Lock`	`150.76525940328983` ns/iter	`151.9574914567795` ns/iter	`0.99`
`JSON_Divisible_By_Decimal`	`245.04143828407328` ns/iter	`244.81844616836216` ns/iter	`1.00`
`JSON_String_Equal/10`	`5.6144308089887085` ns/iter	`5.607531231597118` ns/iter	`1.00`
`JSON_String_Equal/100`	`6.236594159105536` ns/iter	`6.235988969853319` ns/iter	`1.00`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.9354792942028072` ns/iter	`0.9360117145254214` ns/iter	`1.00`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`10.586637120913965` ns/iter	`10.581913215977398` ns/iter	`1.00`
`JSON_String_Fast_Hash/10`	`2.4919425042662184` ns/iter	`2.4906697920258045` ns/iter	`1.00`
`JSON_String_Fast_Hash/100`	`2.49186308145374` ns/iter	`2.499678749829614` ns/iter	`1.00`
`JSON_String_Key_Hash/10`	`2.181764471183173` ns/iter	`2.180809339870137` ns/iter	`1.00`
`JSON_String_Key_Hash/100`	`6.5398395328067265` ns/iter	`6.539938916773623` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Same_Length`	`3.4285931397489033` ns/iter	`3.4524891313927815` ns/iter	`0.99`
`JSON_Object_Defines_Miss_Too_Small`	`3.1662077447208294` ns/iter	`2.9584537889746665` ns/iter	`1.07`
`JSON_Object_Defines_Miss_Too_Large`	`2.633867638085025` ns/iter	`2.653572610963156` ns/iter	`0.99`
`Pointer_Object_Traverse`	`29.35419288251392` ns/iter	`30.136653345422555` ns/iter	`0.97`
`Pointer_Object_Try_Traverse`	`31.227211572591436` ns/iter	`31.91152691082956` ns/iter	`0.98`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`153.8452512521779` ns/iter	`152.06627451954654` ns/iter	`1.01`
`Pointer_Walker_Schema_ISO_Language`	`2644278.484848686` ns/iter	`2607702.817164436` ns/iter	`1.01`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1295922.337638371` ns/iter	`1241307.9946809101` ns/iter	`1.04`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1622215.6009280193` ns/iter	`1597440.108490791` ns/iter	`1.02`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`677.1054438695752` ns/iter	`660.7188810307703` ns/iter	`1.02`
`JSONPath_Descendant_Filter_Nested`	`1598.5290133568485` ns/iter	`1642.0362167739827` ns/iter	`0.97`
`URITemplateRouter_Create`	`31912.861698263565` ns/iter	`32977.8477232687` ns/iter	`0.97`
`URITemplateRouter_Match`	`173.81411527855477` ns/iter	`189.48312325308183` ns/iter	`0.92`
`URITemplateRouter_Match_BasePath`	`203.49542230476186` ns/iter	`209.3659067055763` ns/iter	`0.97`
`URITemplateRouterView_Restore`	`7956.302156322725` ns/iter	`8275.288272357175` ns/iter	`0.96`
`URITemplateRouterView_Match`	`144.34573075566473` ns/iter	`144.22389197386104` ns/iter	`1.00`
`URITemplateRouterView_Match_BasePath`	`166.50455942661273` ns/iter	`166.54683344182004` ns/iter	`1.00`
`URITemplateRouterView_Arguments`	`434.25844589350424` ns/iter	`430.41970082700726` ns/iter	`1.01`
`JSONL_Parse_Large`	`9940350.492957857` ns/iter	`9748508.291666426` ns/iter	`1.02`
`JSONL_Parse_Large_GZIP`	`11349498.540983135` ns/iter	`11326387.419354623` ns/iter	`1.00`
`JSONLD_Catalog_Annotation_List_Populate`	`1258128.5629497096` ns/iter	`1255824.381461599` ns/iter	`1.00`
`JSONLD_Catalog_Materialize`	`4653094.428571328` ns/iter	`4201377.401197457` ns/iter	`1.11`
`HTML_Build_Table_100000`	`69087591.4000003` ns/iter	`68129011.8999982` ns/iter	`1.01`
`HTML_Render_Table_100000`	`5716293.762294508` ns/iter	`5479537.130081257` ns/iter	`1.04`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`33738615.809522256` ns/iter	`33883803.142852485` ns/iter	`1.00`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4438244.512658181` ns/iter	`4082210.7719302373` ns/iter	`1.09`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`1894921.7405406672` ns/iter	`1901567.6902173061` ns/iter	`1.00`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`356019.695519362` ns/iter	`354095.3050505226` ns/iter	`1.01`
`JOSE_VerifySignature_RS256`	`60453.17598755646` ns/iter	`60373.7463431444` ns/iter	`1.00`
`JOSE_VerifySignature_ES512`	`2440959.6842105472` ns/iter	`2450256.7323944615` ns/iter	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

cubic-dev-ai

1 issue found and verified against the latest diff

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/oauth/oauth_dpop.cc">

<violation number="1" location="src/core/oauth/oauth_dpop.cc:244">
P2: Proofs with duplicate payload claims are accepted first-wins, despite JWT requiring unique claim names (or lexical-last parsing). Reject duplicate payload members before reading `jti`, `htm`, `htu`, `iat`, `nonce`, or `ath` to avoid claim interpretation differences with other OAuth components.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-07-20T22:03:12Z

+  }
+
+  // Check 2: a single well-formed JSON Web Token
+  const auto token{JWT::from(proof)};


P2: Proofs with duplicate payload claims are accepted first-wins, despite JWT requiring unique claim names (or lexical-last parsing). Reject duplicate payload members before reading jti, htm, htu, iat, nonce, or ath to avoid claim interpretation differences with other OAuth components.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/core/oauth/oauth_dpop.cc, line 244: <comment>Proofs with duplicate payload claims are accepted first-wins, despite JWT requiring unique claim names (or lexical-last parsing). Reject duplicate payload members before reading `jti`, `htm`, `htu`, `iat`, `nonce`, or `ath` to avoid claim interpretation differences with other OAuth components.</comment> <file context> @@ -0,0 +1,458 @@ + +auto oauth_dpop_proof_thumbprint(const std::string_view proof) + -> std::optional<std::string> { + const auto token{JWT::from(proof)}; + if (!token.has_value()) { + return std::nullopt; </file context>

cubic-dev-ai

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/oauth/include/sourcemeta/core/oauth_dpop.h">

<violation number="1" location="src/core/oauth/include/sourcemeta/core/oauth_dpop.h:231">
P1: Remove `[[nodiscard]]` from `oauth_dpop_verify`. This is a verification function whose return value (`std::optional<OAuthDPoPError>`) carries the proof validation result; discarding it silently skips DPoP verification. The class member functions in the same header (`proof()`, `check_and_insert()`, `size()`) retain `[[nodiscard]]`, so the removal from the free function is inconsistent with the project's own API hygiene pattern.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-07-20T22:10:11Z

+auto oauth_dpop_verify(const std::string_view proof,
+                       const std::string_view method,
+                       const std::string_view url,
+                       const std::chrono::system_clock::time_point now,
+                       const OAuthDPoPVerifyOptions &options)
+    -> std::optional<OAuthDPoPError>;


P1: Remove [[nodiscard]] from oauth_dpop_verify. This is a verification function whose return value (std::optional<OAuthDPoPError>) carries the proof validation result; discarding it silently skips DPoP verification. The class member functions in the same header (proof(), check_and_insert(), size()) retain [[nodiscard]], so the removal from the free function is inconsistent with the project's own API hygiene pattern.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/core/oauth/include/sourcemeta/core/oauth_dpop.h, line 231: <comment>Remove `[[nodiscard]]` from `oauth_dpop_verify`. This is a verification function whose return value (`std::optional<OAuthDPoPError>`) carries the proof validation result; discarding it silently skips DPoP verification. The class member functions in the same header (`proof()`, `check_and_insert()`, `size()`) retain `[[nodiscard]]`, so the removal from the free function is inconsistent with the project's own API hygiene pattern.</comment> <file context> @@ -228,10 +228,12 @@ struct OAuthDPoPVerifyOptions { - const std::string_view proof, const std::string_view method, - const std::string_view url, const std::chrono::system_clock::time_point now, - const OAuthDPoPVerifyOptions &options) -> std::optional<OAuthDPoPError>; +auto oauth_dpop_verify(const std::string_view proof, + const std::string_view method, + const std::string_view url, </file context>

Suggested change

auto oauth_dpop_verify(const std::string_view proof,

const std::string_view method,

const std::string_view url,

const std::chrono::system_clock::time_point now,

const OAuthDPoPVerifyOptions &options)

-> std::optional<OAuthDPoPError>;

[[nodiscard]] auto oauth_dpop_verify(const std::string_view proof,

const std::string_view method,

const std::string_view url,

const std::chrono::system_clock::time_point now,

const OAuthDPoPVerifyOptions &options)

-> std::optional<OAuthDPoPError>;

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions

Benchmark (linux/gcc)

Details

Benchmark suite	Current: `54b2d14`	Previous: `1c2c0f1`	Ratio
`JOSE_VerifySignature_RS256`	`22289.89995422616` ns/iter	`16120.523798488757` ns/iter	`1.38`
`JOSE_VerifySignature_ES512`	`576087.7592440725` ns/iter	`359800.8835300067` ns/iter	`1.60`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`36615004.47368613` ns/iter	`24541034.65625046` ns/iter	`1.49`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4223522.4879516` ns/iter	`3128974.3497755695` ns/iter	`1.35`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2034638.0436046466` ns/iter	`1544296.768722483` ns/iter	`1.32`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`379538.3629951083` ns/iter	`269361.84407058766` ns/iter	`1.41`
`HTML_Build_Table_100000`	`68892280.90000188` ns/iter	`36776507.263159364` ns/iter	`1.87`
`HTML_Render_Table_100000`	`1835063.0550964046` ns/iter	`2843622.424489806` ns/iter	`0.65`
`JSONLD_Catalog_Annotation_List_Populate`	`1310488.0674158204` ns/iter	`863284.3366093771` ns/iter	`1.52`
`JSONLD_Catalog_Materialize`	`6804500.317307736` ns/iter	`4565509.116882926` ns/iter	`1.49`
`JSONL_Parse_Large`	`13765398.921566652` ns/iter	`8307303.595237786` ns/iter	`1.66`
`JSONL_Parse_Large_GZIP`	`14752936.702127451` ns/iter	`9316791.92000047` ns/iter	`1.58`
`URITemplateRouter_Create`	`30414.212344280782` ns/iter	`19099.202060113617` ns/iter	`1.59`
`URITemplateRouter_Match`	`150.7673534600958` ns/iter	`110.42960582853183` ns/iter	`1.37`
`URITemplateRouter_Match_BasePath`	`171.6643539994485` ns/iter	`118.87075168501141` ns/iter	`1.44`
`URITemplateRouterView_Restore`	`8583.767972002403` ns/iter	`2400.577427148385` ns/iter	`3.58`
`URITemplateRouterView_Match`	`123.77410798778143` ns/iter	`80.97125255900579` ns/iter	`1.53`
`URITemplateRouterView_Match_BasePath`	`146.04928586302975` ns/iter	`92.11817570188096` ns/iter	`1.59`
`URITemplateRouterView_Arguments`	`563.4469353788751` ns/iter	`367.9664956277469` ns/iter	`1.53`
`JSONPath_Descendant_Filter_Nested`	`1719.7997933176716` ns/iter	`1011.2357365224242` ns/iter	`1.70`
`Pointer_Object_Traverse`	`32.4914976760673` ns/iter	`21.172521619784064` ns/iter	`1.53`
`Pointer_Object_Try_Traverse`	`25.845955308411252` ns/iter	`19.772334121494904` ns/iter	`1.31`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`150.9248884219012` ns/iter	`109.01614559852608` ns/iter	`1.38`
`Pointer_Walker_Schema_ISO_Language`	`2737157.648437627` ns/iter	`1760580.5454545352` ns/iter	`1.55`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1845135.557640539` ns/iter	`1422809.404471613` ns/iter	`1.30`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1723938.9557738143` ns/iter	`1223318.1940559575` ns/iter	`1.41`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`509.9284314335162` ns/iter	`339.4474242098625` ns/iter	`1.50`
`JSON_Array_Of_Objects_Unique`	`464.8650795601708` ns/iter	`235.29171339920322` ns/iter	`1.98`
`JSON_Parse_1`	`9654.307475840133` ns/iter	`6118.635974829568` ns/iter	`1.58`
`JSON_Parse_Real`	`8014.52570206531` ns/iter	`4705.714218664015` ns/iter	`1.70`
`JSON_Parse_Decimal`	`12901.857508753093` ns/iter	`7930.2076581112115` ns/iter	`1.63`
`JSON_Parse_Schema_ISO_Language`	`6674011.64150975` ns/iter	`4793607.965753347` ns/iter	`1.39`
`JSON_Parse_Integer`	`5805.7849117994065` ns/iter	`3844.6051775435717` ns/iter	`1.51`
`JSON_Parse_String_NonSSO_Plain`	`12068.536419742519` ns/iter	`8755.076327222305` ns/iter	`1.38`
`JSON_Parse_String_SSO_Plain`	`5207.038257085992` ns/iter	`3123.655631980411` ns/iter	`1.67`
`JSON_Parse_String_Escape_Heavy`	`25658.58998124042` ns/iter	`17815.203301168214` ns/iter	`1.44`
`JSON_Parse_Object_Short_Keys`	`13498.488722531001` ns/iter	`8826.774610432818` ns/iter	`1.53`
`JSON_Parse_Object_Scalar_Properties`	`6921.862718318751` ns/iter	`4368.1354661976375` ns/iter	`1.58`
`JSON_Parse_Object_Array_Properties`	`12170.739290761583` ns/iter	`7396.061950270568` ns/iter	`1.65`
`JSON_Parse_Object_Object_Properties`	`11729.12339638853` ns/iter	`7380.879222162478` ns/iter	`1.59`
`JSON_Parse_Nested_Containers`	`97296.01461581697` ns/iter	`64644.301822214264` ns/iter	`1.51`
`JSON_From_String_Copy`	`17.737033795948243` ns/iter	`13.120662640882566` ns/iter	`1.35`
`JSON_From_String_Temporary`	`15.0425192041766` ns/iter	`11.47747718533662` ns/iter	`1.31`
`JSON_Number_To_Double`	`20.644695834074103` ns/iter	`14.076566228299058` ns/iter	`1.47`
`JSON_Object_At_Last_Key/8`	`3.8157304003181123` ns/iter	`3.118289476339198` ns/iter	`1.22`
`JSON_Object_At_Last_Key/32`	`12.26677931964898` ns/iter	`9.700098641735636` ns/iter	`1.26`
`JSON_Object_At_Last_Key/128`	`48.93720486032114` ns/iter	`45.078291556942524` ns/iter	`1.09`
`JSON_Object_At_Last_Key/512`	`370.6113815267759` ns/iter	`154.81579639536378` ns/iter	`2.39`
`JSON_Fast_Hash_Helm_Chart_Lock`	`83.50889115729397` ns/iter	`35.83448750261832` ns/iter	`2.33`
`JSON_Equality_Helm_Chart_Lock`	`148.26321492215314` ns/iter	`89.80393363095327` ns/iter	`1.65`
`JSON_Divisible_By_Decimal`	`250.28411158566485` ns/iter	`177.83197487160433` ns/iter	`1.41`
`JSON_String_Equal/10`	`5.48751365336923` ns/iter	`3.1841955273382196` ns/iter	`1.72`
`JSON_String_Equal/100`	`6.18962922930336` ns/iter	`4.143523561654992` ns/iter	`1.49`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.6246031446759664` ns/iter	`0.6930717755801125` ns/iter	`0.90`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`25.21224722187004` ns/iter	`13.201756945051018` ns/iter	`1.91`
`JSON_String_Fast_Hash/10`	`2.570678600945744` ns/iter	`1.5476330532896134` ns/iter	`1.66`
`JSON_String_Fast_Hash/100`	`2.5706503287614204` ns/iter	`1.5478603520258811` ns/iter	`1.66`
`JSON_String_Key_Hash/10`	`1.246243614608034` ns/iter	`0.6085154028062943` ns/iter	`2.05`
`JSON_String_Key_Hash/100`	`12.447061182008422` ns/iter	`9.87054395802615` ns/iter	`1.26`
`JSON_Object_Defines_Miss_Same_Length`	`3.1129798998778497` ns/iter	`2.0412279567764577` ns/iter	`1.53`
`JSON_Object_Defines_Miss_Too_Small`	`3.1147262946668444` ns/iter	`2.2654455259192554` ns/iter	`1.37`
`JSON_Object_Defines_Miss_Too_Large`	`3.1162449070094858` ns/iter	`2.2196779809063787` ns/iter	`1.40`
`Regex_Lower_S_Or_Upper_S_Asterisk`	`0.6228192039429561` ns/iter	`0.36040253928528787` ns/iter	`1.73`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`0.622742752881401` ns/iter	`0.36032422774939943` ns/iter	`1.73`
`Regex_Period_Asterisk`	`0.6226402660153513` ns/iter	`0.3603152981954473` ns/iter	`1.73`
`Regex_Group_Period_Asterisk_Group`	`0.6238507596791021` ns/iter	`0.3604754773330087` ns/iter	`1.73`
`Regex_Period_Plus`	`0.6229186826530774` ns/iter	`0.36014620219063037` ns/iter	`1.73`
`Regex_Period`	`0.6222037637210223` ns/iter	`0.3602814168564026` ns/iter	`1.73`
`Regex_Caret_Period_Plus_Dollar`	`0.6230391019889854` ns/iter	`0.3601254909439891` ns/iter	`1.73`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`0.6227705493610951` ns/iter	`0.3602087964118885` ns/iter	`1.73`
`Regex_Caret_Period_Asterisk_Dollar`	`0.6233542845280847` ns/iter	`0.3602812022942287` ns/iter	`1.73`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`0.6232232089603443` ns/iter	`0.36671599161692653` ns/iter	`1.70`
`Regex_Caret_X_Hyphen`	`3.7406676430540196` ns/iter	`1.5022739776541671` ns/iter	`2.49`
`Regex_Period_Md_Dollar`	`29.74204800727903` ns/iter	`15.690435348469261` ns/iter	`1.90`
`Regex_Caret_Slash_Period_Asterisk`	`4.047711241561264` ns/iter	`1.503983193171789` ns/iter	`2.69`
`Regex_Caret_Period_Range_Dollar`	`1.2456819503908476` ns/iter	`1.203473577305924` ns/iter	`1.04`
`Regex_Nested_Backtrack`	`38.17833391801438` ns/iter	`24.501158663771687` ns/iter	`1.56`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (windows/msvc)

Details

Benchmark suite	Current: `54b2d14`	Previous: `1c2c0f1`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`5.356070000000273` ns/iter	`5.386759821429824` ns/iter	`0.99`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`5.054520000001048` ns/iter	`5.023406261213267` ns/iter	`1.01`
`Regex_Period_Asterisk`	`5.043246000000181` ns/iter	`5.019426785714082` ns/iter	`1.00`
`Regex_Group_Period_Asterisk_Group`	`5.041957000000821` ns/iter	`5.1016820000018015` ns/iter	`0.99`
`Regex_Period_Plus`	`5.042253999999957` ns/iter	`5.033688392856562` ns/iter	`1.00`
`Regex_Period`	`5.381855357143195` ns/iter	`5.352449000001798` ns/iter	`1.01`
`Regex_Caret_Period_Plus_Dollar`	`5.027037499999665` ns/iter	`5.040701000000354` ns/iter	`1.00`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`5.36605892857064` ns/iter	`5.329360999999153` ns/iter	`1.01`
`Regex_Caret_Period_Asterisk_Dollar`	`5.3553714285702165` ns/iter	`5.33251799999789` ns/iter	`1.00`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`5.037535714285874` ns/iter	`5.096023000000969` ns/iter	`0.99`
`Regex_Caret_X_Hyphen`	`8.500658482142954` ns/iter	`8.501572729902803` ns/iter	`1.00`
`Regex_Period_Md_Dollar`	`44.7991624999986` ns/iter	`44.57177970917245` ns/iter	`1.01`
`Regex_Caret_Slash_Period_Asterisk`	`7.886213169643647` ns/iter	`7.84601339285881` ns/iter	`1.01`
`Regex_Caret_Period_Range_Dollar`	`6.0589625000001694` ns/iter	`5.959042857142549` ns/iter	`1.02`
`Regex_Nested_Backtrack`	`56.11223000000791` ns/iter	`55.1570357142899` ns/iter	`1.02`
`JSON_Array_Of_Objects_Unique`	`601.2382999999772` ns/iter	`602.1700000001066` ns/iter	`1.00`
`JSON_Parse_1`	`8889.4866071446` ns/iter	`9053.395089286503` ns/iter	`0.98`
`JSON_Parse_Real`	`16064.544405434295` ns/iter	`16213.779556557856` ns/iter	`0.99`
`JSON_Parse_Decimal`	`11838.894642859746` ns/iter	`11779.639062503122` ns/iter	`1.01`
`JSON_Parse_Schema_ISO_Language`	`7813764.444444536` ns/iter	`7205309.999999877` ns/iter	`1.08`
`JSON_Parse_Integer`	`6110.570535714795` ns/iter	`6141.302678571493` ns/iter	`0.99`
`JSON_Parse_String_NonSSO_Plain`	`8039.1484374991205` ns/iter	`7777.719866070804` ns/iter	`1.03`
`JSON_Parse_String_SSO_Plain`	`3765.194705008592` ns/iter	`3607.533511651512` ns/iter	`1.04`
`JSON_Parse_String_Escape_Heavy`	`21914.368749996527` ns/iter	`21578.109374999596` ns/iter	`1.02`
`JSON_Parse_Object_Short_Keys`	`13291.09245048264` ns/iter	`13401.63749999793` ns/iter	`0.99`
`JSON_Parse_Object_Scalar_Properties`	`6839.84732142814` ns/iter	`6884.620535712673` ns/iter	`0.99`
`JSON_Parse_Object_Array_Properties`	`11220.837499998026` ns/iter	`11255.589062500349` ns/iter	`1.00`
`JSON_Parse_Object_Object_Properties`	`11448.599999997812` ns/iter	`11444.410714286083` ns/iter	`1.00`
`JSON_Parse_Nested_Containers`	`78094.17410713187` ns/iter	`78775.99330356081` ns/iter	`0.99`
`JSON_From_String_Copy`	`64.03261607143155` ns/iter	`64.0103124999923` ns/iter	`1.00`
`JSON_From_String_Temporary`	`57.85005357144055` ns/iter	`59.184330357148994` ns/iter	`0.98`
`JSON_Number_To_Double`	`119.66803571429604` ns/iter	`123.81098214283222` ns/iter	`0.97`
`JSON_Object_At_Last_Key/8`	`7.241173214284556` ns/iter	`7.266455357142527` ns/iter	`1.00`
`JSON_Object_At_Last_Key/32`	`23.412980765482267` ns/iter	`23.42133456002793` ns/iter	`1.00`
`JSON_Object_At_Last_Key/128`	`90.12896919066854` ns/iter	`89.28625047831488` ns/iter	`1.01`
`JSON_Object_At_Last_Key/512`	`426.5583750000701` ns/iter	`422.4411619884812` ns/iter	`1.01`
`JSON_Fast_Hash_Helm_Chart_Lock`	`102.59882812498235` ns/iter	`102.37540624999042` ns/iter	`1.00`
`JSON_Equality_Helm_Chart_Lock`	`233.70680427377584` ns/iter	`237.4558571428257` ns/iter	`0.98`
`JSON_Divisible_By_Decimal`	`301.613169570784` ns/iter	`297.80689979830817` ns/iter	`1.01`
`JSON_String_Equal/10`	`10.40711718749776` ns/iter	`10.379414062498427` ns/iter	`1.00`
`JSON_String_Equal/100`	`11.672969642855183` ns/iter	`11.933780357143828` ns/iter	`0.98`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`2.5563371428566892` ns/iter	`2.5176559798950864` ns/iter	`1.02`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`15.09764457545805` ns/iter	`14.273336989847355` ns/iter	`1.06`
`JSON_String_Fast_Hash/10`	`6.612525892858149` ns/iter	`6.724958035714426` ns/iter	`0.98`
`JSON_String_Fast_Hash/100`	`6.585736607141663` ns/iter	`6.749149553572562` ns/iter	`0.98`
`JSON_String_Key_Hash/10`	`5.341878000001543` ns/iter	`5.464437000000544` ns/iter	`0.98`
`JSON_String_Key_Hash/100`	`11.913450000000532` ns/iter	`11.92121964285369` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Same_Length`	`3.8042873883930333` ns/iter	`3.7831257306965407` ns/iter	`1.01`
`JSON_Object_Defines_Miss_Too_Small`	`4.1066112126907095` ns/iter	`4.104877498166922` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Too_Large`	`3.7918989955354476` ns/iter	`3.769479100411857` ns/iter	`1.01`
`Pointer_Object_Traverse`	`70.83813392857304` ns/iter	`70.630142857157` ns/iter	`1.00`
`Pointer_Object_Try_Traverse`	`72.25188392855638` ns/iter	`71.46206473215447` ns/iter	`1.01`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`160.14524553570806` ns/iter	`181.0459983076937` ns/iter	`0.88`
`Pointer_Walker_Schema_ISO_Language`	`10772089.062498935` ns/iter	`10944017.187501486` ns/iter	`0.98`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`2430932.530120869` ns/iter	`2432018.875502164` ns/iter	`1.00`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`3799899.9999998864` ns/iter	`3741732.3076927764` ns/iter	`1.02`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`531.1964556768991` ns/iter	`566.5955138180142` ns/iter	`0.94`
`JSONPath_Descendant_Filter_Nested`	`2435.5542857140986` ns/iter	`2415.4464285719055` ns/iter	`1.01`
`URITemplateRouter_Create`	`40569.10800301571` ns/iter	`40344.52440368456` ns/iter	`1.01`
`URITemplateRouter_Match`	`234.5550073041423` ns/iter	`234.2816926025044` ns/iter	`1.00`
`URITemplateRouter_Match_BasePath`	`266.23708777842324` ns/iter	`265.24406764488464` ns/iter	`1.00`
`URITemplateRouterView_Restore`	`33265.082266900965` ns/iter	`33999.24376350565` ns/iter	`0.98`
`URITemplateRouterView_Match`	`181.1515072457024` ns/iter	`180.16881563633393` ns/iter	`1.01`
`URITemplateRouterView_Match_BasePath`	`205.59269841104822` ns/iter	`205.01913147235814` ns/iter	`1.00`
`URITemplateRouterView_Arguments`	`534.8587500001096` ns/iter	`531.9394999999076` ns/iter	`1.01`
`JSONL_Parse_Large`	`32516527.272729363` ns/iter	`32803823.809531637` ns/iter	`0.99`
`JSONL_Parse_Large_GZIP`	`33338285.000002086` ns/iter	`33386214.28571016` ns/iter	`1.00`
`JSONLD_Catalog_Annotation_List_Populate`	`2676223.8636368955` ns/iter	`2681240.5303024375` ns/iter	`1.00`
`JSONLD_Catalog_Materialize`	`8739149.333332533` ns/iter	`7731357.777775984` ns/iter	`1.13`
`HTML_Build_Table_100000`	`90172357.14285173` ns/iter	`88843022.2222117` ns/iter	`1.01`
`HTML_Render_Table_100000`	`7879282.222221364` ns/iter	`7590938.888888053` ns/iter	`1.04`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`35980526.31578915` ns/iter	`36222884.21052202` ns/iter	`0.99`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`10181414.062497396` ns/iter	`9805549.33333527` ns/iter	`1.04`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2106448.1159417327` ns/iter	`2112936.5624993565` ns/iter	`1.00`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`630279.3749999377` ns/iter	`619523.571428512` ns/iter	`1.02`
`JOSE_VerifySignature_RS256`	`21253.824502346673` ns/iter	`21234.593750001808` ns/iter	`1.00`
`JOSE_VerifySignature_ES512`	`1535116.2946432494` ns/iter	`1545233.9285713735` ns/iter	`0.99`

This comment was automatically generated by workflow using github-action-benchmark.

Implement DPoP proofs, verification, and replay protection for OAuth

a79d346

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

jviotti commented Jul 20, 2026

View reviewed changes

augmentcode Bot reviewed Jul 20, 2026

View reviewed changes

jviotti commented Jul 20, 2026

View reviewed changes

More

e47e75a

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions Bot reviewed Jul 20, 2026

View reviewed changes

More

4ce66bb

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions Bot reviewed Jul 20, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Jul 20, 2026

View reviewed changes

jviotti added 2 commits July 20, 2026 19:10

Fix

37192b3

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

Fix

54b2d14

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

github-actions Bot reviewed Jul 20, 2026

View reviewed changes

jviotti merged commit 7581b8c into main Jul 20, 2026
11 of 12 checks passed

jviotti deleted the oauth-dpop branch July 20, 2026 22:42


		} // namespace

		OAuthDPoPProofer::OAuthDPoPProofer(JWKPrivate key, const JWSAlgorithm algorithm)

Uh oh!

Uh oh!

Conversation

jviotti commented Jul 20, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jviotti Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot commented Jul 20, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jviotti Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

jviotti Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Benchmark (macos/llvm)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/llvm)

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/gcc)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (windows/msvc)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jviotti commented Jul 20, 2026 •

edited by cubic-dev-ai Bot

Loading

augmentcode Bot Jul 20, 2026 •

edited

Loading

augmentcode Bot Jul 20, 2026 •

edited

Loading

augmentcode Bot Jul 20, 2026 •

edited

Loading

augmentcode Bot Jul 20, 2026 •

edited

Loading

github-actions Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading