fn dpop_bearer(headers: &HeaderMap) -> Result<Option<(String, &str)>, ApiError>Expand description
The DPoP credential scheme’s raw pieces, straight off the
Authorization and DPoP headers — deliberately not routed through
present/Presented, which still folds DPoP into
Presented::Disabled for every other route in this module that has
not opted into accepting it (see DISABLED_SCHEMES’s own doc). Kept to
exactly the two headers a caller presenting this scheme sends, mirroring
present’s own header-splitting rather than growing that function a
third scheme every existing call site would need a new match arm for.
None when the credential is not in the DPoP scheme. A DPoP
credential beside no proof, or more than one, is refused as a bad proof
(RFC 9449 §4.3, §7.1).