pub fn request_htu(
registry: &dyn Registry,
path: &str,
) -> Result<String, DiscoveryError>Expand description
The absolute htu a DPoP proof must bind to for a request this
deployment serves at path — RFC 9449 §4.3’s “a caller-built canonical
absolute URL (scheme, host, and path)”, built the same way
issuer_for builds issuer: read out of this deployment’s own zone
service document rather than the request’s Host header or any
X-Forwarded-* header, both of which are ordinary caller-supplied text
once didbot-tls is terminating TLS itself with no reverse proxy in
front rewriting anything — see crate::rate_limit’s own doc for the same
argument applied to a caller’s address. This also gets a development
deployment’s plain-http *.localhost origin and a production
deployment’s https:// origin right for free, in both directions,
because whichever one is true is already baked into the service document
an operator configured, not computed here.
path is expected to start with /, matching every route this crate’s
router registers ("/oauth/token", and so on).