Hi all, I have created a program for OIDC Authorization Code Flow (ID Tokens and User Access Tokens). When receiving my jwt, it validates correctly against the jwk, but the payload does not have a nonce value. The value is just misssing, not empty or incorrect, missing. the access_token is valid …

Barkspawn Closed September 27, 2017, 10:07pm 2

The “nonce” value is still important in the code flow for OAuth and OIDC flows to prevent CSRF attacks on the “Authorize” screen. This is a bug in our implementation, we’ll address shortly. Thanks for reporting! For more information on nonces, http://openid.net/specs/openid-connect-core-1_0.html#NonceNotes provides the context we have built our OIDC implementation to

show post in topic

Home
Categories
FAQ/Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled

Nonce missing from jwt