Skip to content

Fixed ID token nonce claim validation #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
route443 merged 7 commits into from
Oct 24, 2024
Merged

Fixed ID token nonce claim validation #104

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
561ba74
Fixed ID token nonce claim validation
jo-carter Oct 23, 2024
94703db
Improve token nonce claim validation to better comply with OIDC spec.
ag-TJNII Oct 24, 2024
f0cdaf0
Merge pull request #1 from ag-TJNII/nonce-validation-fix
jo-carter Oct 24, 2024
917bbfd
Adjusted Style & Log Messages.
jo-carter Oct 24, 2024
0560f83
Removed no nonce claim warning for refresh case
jo-carter Oct 24, 2024
183e449
Adjusted missing nonce claim error message
jo-carter Oct 24, 2024
46cbc26
Adjusted reference to OIDC documentation in comment.
jo-carter Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions openid_connect.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,6 @@
*
* Copyright (C) 2020 Nginx, Inc.
*/
var newSession = false; // Used by oidcAuth() and validateIdToken()

export default {auth, codeExchange, validateIdToken, logout};

function retryOriginalRequest(r) {
Expand Down Expand Up @@ -32,8 +30,6 @@ function auth(r, afterSyncCheck) {
}

if (!r.variables.refresh_token || r.variables.refresh_token == "-") {
newSession = true;

// Check we have all necessary configuration variables (referenced only by njs)
var oidcConfigurables = ["authz_endpoint", "scopes", "hmac_key", "cookie_flags"];
var missingConfig = [];
Expand Down Expand Up @@ -241,10 +237,9 @@ function validateIdToken(r) {
validToken = false;
}

// If we receive a nonce in the ID Token then we will use the auth_nonce cookies
// to check that the JWT can be validated as being directly related to the
// original request by this client. This mitigates against token replay attacks.
if (newSession) {
// According to OIDC Core 1.0 Section 2:
// "If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request."
if (r.variables.jwt_claim_nonce) {
var client_nonce_hash = "";
if (r.variables.cookie_auth_nonce) {
var c = require('crypto');
Expand All @@ -255,6 +250,9 @@ function validateIdToken(r) {
r.error("OIDC ID Token validation error: nonce from token (" + r.variables.jwt_claim_nonce + ") does not match client (" + client_nonce_hash + ")");
validToken = false;
}
} else if (!r.variables.refresh_token || r.variables.refresh_token == "-") {
r.error("OIDC ID Token validation error: missing nonce claim in ID Token during initial authentication.");
validToken = false;
}

if (validToken) {
Expand Down