inrupt / inrupt/solid-client-authn-js
NSS 5.6.12 doesn't include a nonce claim in id tokens it issues
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 77
- Forks
- 49
- Avg merge
- 18h 20m
- Merged PRs (30d)
- 32
Description
Testing OpenLink Virtuoso as an RP against https://solidcommunity.net, Virtuoso includes a nonce in its token request. The returned id token doesn't include a nonce claim. The id token validation by Virtuoso fails as a result.
Please see https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
3.1.3.7. ID Token Validation
Step 11. If a nonce value was sent in the Authentication Request, a nonce Claim
must be present and its value checked to verify that it is the same
value as the one that was sent in the Authentication Request...
The authorization request is:
https://solidcommunity.net/authorize?
redirect_uri=https%3A%2F%2Flocalhost%3A4443%2Fval%2Fapi%2Fthirdparty_callback
&client_id=...
&response_type=code
&scope=openid%20email%20profile
&nonce=beafc9ce...
...
I think this is consistent with https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Reproduce the authorization request with its nonce against the token-issuing flow, then trace how the ID token is built and compare it with the OpenID Connect validation requirements cited in the issue. Done means the returned ID token contains the request's nonce claim and the relevant validation scenario passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100