Feature Request: Support OpenID Connect Token Validation
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1k
- Forks
- 165
- PR merge metrics
- No merged PRs in 30d
Description
AppAuth for iOS recently added support for OpenID Connect ID Token validation (but not signature verification, electing to use the option allowed in the specification for not verifying signatures of ID Tokens received over TLS from the token endpoint).
This feature was added in two stages:
1/ Add support for 'nonce' on the authorization request
2/ Parse the ID Token (if any) and validate the fields according to OpenID Connect Core Section 3.1.3.7 (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).
With this feature in place, we were also then able to implement the OpenID Connect RP Certification test suite, which is now part of our test suite that runs on CI.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the referenced AppAuth-iOS commits for nonce support, ID Token parsing, and validation against OpenID Connect Core Section 3.1.3.7, then locate the corresponding authorization and token-handling entry points in AppAuth-JS. Done means supporting nonce, parsing and validating returned ID Tokens, and adding the OpenID Connect RP Certification tests to the CI test suite.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100