fix(dpop): sign XmlHttpReq + refresh

2026-08-09 01:39:27 +02:00
parent 82bd2e4d22
commit a7653339b1
3 changed files with 142 additions and 50 deletions
@@ -37,7 +37,15 @@ function loadNonceOnce(): void {

 /** Update the nonce state from a fresh `DPoP-Nonce` response header. */
 export function updateNonceFromResponse(response: Response): void {
-	const fresh = response.headers.get('DPoP-Nonce');
+	updateNonceFromHeader(response.headers.get('DPoP-Nonce'));
+}
+
+/**
+ * Update the nonce state from a raw header value — for callers that
+ * don't have a `fetch` `Response` (e.g. the `XMLHttpRequest` upload
+ * path, which needs XHR for upload-progress events).
+ */
+export function updateNonceFromHeader(fresh: string | null): void {
 	if (!fresh || fresh === currentNonce) return;
 	currentNonce = fresh;
 	try {