[osanderson]

Lets a wallet use the DPoP nonce an OpenID4VCI Nonce Response carries, and ask for issuer metadata in the user's language. Both changes are additive; nothing breaks.

Why

DPoP nonce. OpenID4VCI 1.0 §7.2 lets the Credential Issuer's Nonce Response carry a DPoP-Nonce header, which "the Wallet uses ... when presenting an access token at the Credential Endpoint". A FAPIgo-based wallet couldn't do that, for two reasons:

• fapihttp never returned response headers, so the only way to read one was to bypass its hardening.
• ResourceClient had no way to take a nonce it was handed elsewhere: seeding its cache meant copying the unexported key format.

So the first Credential Request was always challenged with use_dpop_nonce and retried.

Accept-Language. OpenID4VCI 1.0 §12.2.2 recommends sending Accept-Language on the issuer-metadata request, so display metadata comes in the user's language. fapihttp had no way to send it.

Changes

• fapihttp.FetchResponse.Header: the response's header fields, the final response's after any redirects, as a copy. Filled by both Fetch and Post.
• FetchRequest.AcceptLanguage and PostRequest.AcceptLanguage: sent as Accept-Language (RFC 9110 §12.5.4), under Accept's rules: printable ASCII, at most 1024 bytes.
  • It's a named field rather than a general header map. The headers fapihttp sends, and the absence of the rest (cookies, credentials), are part of what it hardens.
• client.ResourceClient.UseDPoPNonce(ctx, resource, nonce): the next Do to that origin presents the nonce.
  • It goes through the nonce cache every client has had since fix(client)!: client fixes from the 2026-10-18 review #685.
  • A wrong or stale nonce costs only the challenge and retry Do already handles. The nonce is a hint, not a credential.
  • It does nothing under mTLS.

Testing

• fapihttp:
  • Accept-Language is sent on every redirect hop and on a POST;
  • Header holds the final response's headers, as a copy;
  • an Accept-Language with CRLF, or over 1024 bytes, is refused before any request.
• client: after UseDPoPNonce, the first Do presents the nonce and isn't challenged; a stale one gets one challenge and a retry.
• Checks:
  • go vet, go test ./..., and go test -race on Go 1.26.9 for fapihttp and client;
  • golangci-lint (0 issues);
  • arm vet;
  • every demo module.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 93.10345% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
client/resource.go	50.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
95.8% Coverage on New Code
1.7% Duplication on New Code

See analysis details on SonarQube Cloud