MaikuB / MaikuB/flutter_appauth
Add ability to set nonce as null
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 308
- Forks
- 301
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 5
Description
If the authorization server does not support nonce, the authorization fails with the following error:
{"type":0,"code":9,"errorDescription":"Invalid ID Token"}
The issue is pretty straightforward — after the token exchange, the native library performs token validation. Since the authorization request automatically sets its own nonce by default (and we don’t override it), but the token response lacks a nonce, the library throws an exception.
The native appAuth library says the for servers that does not support nonce we need to set nonce as null (https://github.com/openid/AppAuth-Android) but Flutter plugin ignore this functionality:
` FlutterAppauthPlugin.java
if (nonce != null) {
authRequestBuilder.setNonce(nonce);
}
`
Please add the ability to set nonce as null for such cases
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the nonce handling in FlutterAppauthPlugin.java and review the linked AppAuth-Android behavior for servers that do not support nonce. Trace how nonce configuration reaches token validation on each native platform. Done means callers can explicitly disable nonce handling and authorization succeeds when the token response omits nonce.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, flutter, ios, java
- Domain
- mobile
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100