Use request.nonce when generating hybrid id token #747
Conversation
|
I see two ways of fixing this. The first is what is in the PR, which follows how this is done in OIDC auth code flow and OIDC implicit flow, to override The second is to do away with all these overrides (and |
| @@ -35,6 +35,9 @@ def __init__(self, request_validator=None, **kwargs): | |||
| self.register_code_modifier(self.add_id_token) | |||
| self.register_token_modifier(self.add_id_token) | |||
|
|
|||
| def add_id_token(self, token, token_handler, request): | |||
| return super().add_id_token(token, token_handler, request, nonce=request.nonce) | |||
There was a problem hiding this comment.
is this nonce related to this? https://stackoverflow.com/questions/3690738/need-help-understanding-nonce
There was a problem hiding this comment.
Yep, or better description is in the spec. Its used to prevent replay attacks, the client generates a random nonce and stores it in a session, and then compares the nonce in the response with the nonce in the session. If it is missing either in the session or the response, or does not match, the response is invalid.
Its a required parameter for the implicit flow, a sometimes required parameter for the hybrid flow and an optional parameter for authorization code flow.
Handling it, however, is not optional - if a nonce is presented in the authorization endpoint, it must be in the ID token or a client should reject the response as invalid.
|
Hi @tevansuk , good catch ! However note that nonce is optional for "code token" in hybrid mode, as highlighted in oauthlib/oauthlib/openid/connect/core/grant_types/base.py Lines 115 to 123 in d54965b |
|
Thanks for the review! I'm not sure that text is correct by the way. The spec says that it is an optional authentication request parameter in certain flows, and required in other flows, but it can be specified in all of them, and if it is used, the server must include it in the ID token, and clients must verify it - section 2 (ID Token)
Then in section 3.3.2.11 (Hybrid Flow - ID Token):
For "code token" of course, the id token is retrieved by the auth code flow grant handler, which handles it the same as a standard auth code, so it did already work correctly for that case! |
Like with the implicit grant, we need to override add_id_token to pass the nonce from the current request to GrantBase.add_id_token in order for the ID token to have the correct nonce. Add test that the nonce is in ID token from hybrid OIDC flow. Fixes: oauthlib#746
9d16e1f to
707df8c
Compare
Like with the implicit grant, we need to override
add_id_tokento pass the nonce from the current request toGrantBase.add_id_tokenin order for the ID token to have the correct nonce.Add test that the nonce is in ID token from hybrid OIDC flow.
Fixes: #746