Add nonce support #769
Open
Add nonce support #769
+135
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add optional nonce parameter to client startAuthorization() - Auto-generate nonce when scope includes 'openid' - Pass nonce through server authorization handler - Update AuthorizationParams type to include nonce - Add comprehensive tests for nonce handling This enables proper OpenID Connect security by preventing replay attacks on ID tokens.
- Add afterEach to restore all mocks - Remove unnecessary mockClear() calls - Ensures tests are properly isolated
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds nonce parameter support to OAuth/OIDC authorization flows to prevent replay attacks on ID tokens.
Motivation and Context
Supporting nonces are necessary for id_token flows to prevent replay attacks.
How Has This Been Tested?
Just jest / automated tests. The changes are relatively minor, though.
Breaking Changes
The return type of
startAuthorization()now includes an optionalnoncefield.Hypothetically, someone could have provided explicit types on the return value like this:
const result: { authorizationUrl: URL; codeVerifier: string } = await startAuthorization(...);Which would now be a type error, but I don't see why anyone would have an explicit type annotation there.
Types of changes
Checklist
Additional context