feat: add include_jti flag to control jti claim inclusion in DPoP proof generation

Author: kishore7snehil

packages/auth0_api_python/src/auth0_api_python/token_utils.py

@@ -106,7 +106,8 @@ async def generate_dpop_proof(
     iat: bool = True,
     claims: Optional[dict[str, Any]] = None,
     header_overrides: Optional[dict[str, Any]] = None,
-    iat_time: Optional[int] = None
+    iat_time: Optional[int] = None,
+    include_jti: bool = True
 ) -> str:
     """
     Generates a real ES256-signed DPoP proof JWT using the EC private key above.
@@ -120,6 +121,7 @@ async def generate_dpop_proof(
         claims: Additional custom claims to merge into the proof.
         header_overrides: Override header parameters (e.g., for testing invalid headers).
         iat_time: Fixed time for iat claim (for testing). If None, uses current time.
+        include_jti: Whether to include the 'jti' claim. If False, jti is completely omitted.
 
     Returns:
         An ES256-signed DPoP proof JWT string.
@@ -140,10 +142,11 @@ async def generate_dpop_proof(
     if iat:
         proof_claims["iat"] = iat_time if iat_time is not None else int(time.time())
 
-    if jti is not None:
-        proof_claims["jti"] = jti
-    else:
-        proof_claims["jti"] = str(uuid.uuid4())
+    if include_jti:
+        if jti is not None:
+            proof_claims["jti"] = jti
+        else:
+            proof_claims["jti"] = str(uuid.uuid4())
 
     proof_claims["htm"] = http_method
     proof_claims["htu"] = normalize_url_for_htu(http_url)

packages/auth0_api_python/tests/test_api_client.py

@@ -970,22 +970,14 @@ async def test_verify_dpop_proof_with_missing_jti():
     """Test verify_dpop_proof with missing jti claim."""
     access_token = "test_token"
 
+    # Generate DPoP proof WITHOUT jti claim from the start
     dpop_proof = await generate_dpop_proof(
         access_token=access_token,
         http_method="GET",
         http_url="https://api.example.com/resource",
-        jti=None,
-        claims={"jti": None}
+        include_jti=False  # Completely omit jti claim
     )
 
-    parts = dpop_proof.split('.')
-    if len(parts) == 3:
-        header, payload, signature = parts
-        decoded_payload = json.loads(base64.urlsafe_b64decode(payload + '=' * (4 - len(payload) % 4)).decode('utf-8'))
-        del decoded_payload['jti']
-        modified_payload = base64.urlsafe_b64encode(json.dumps(decoded_payload).encode('utf-8')).decode('utf-8').rstrip('=')
-        dpop_proof = f"{header}.{modified_payload}.{signature}"
-
     api_client = ApiClient(ApiClientOptions(domain="auth0.local", audience="my-audience"))
     with pytest.raises(InvalidDpopProofError) as err:
         await api_client.verify_dpop_proof(
@@ -994,7 +986,7 @@ async def test_verify_dpop_proof_with_missing_jti():
             http_method="GET",
             http_url="https://api.example.com/resource"
         )
-    assert "signature verification failed" in str(err.value).lower()
+    assert "missing required claim: jti" in str(err.value).lower()
 
 @pytest.mark.asyncio
 async def test_verify_dpop_proof_fail_htm_mismatch():