feat(oauth2): make nonce settable when response_type includes 'token'

[gagandeep]

Keycloak required nonce for response_type=token but there was no way I was able to set nonce.

[gagandeep]

@pi0 & @JoaoPedroAS51 Please review this.

[jkupcho]

You can enforce a nonce being sent by setting the response_type to id_token.

See:
https://github.com/nuxt-community/auth-module/blob/v4.9.1/lib/schemes/oauth2.js#L106

[gagandeep]

@jkupcho I agree with you. But, If I need to set nonce without id_token like in my case. It was not possible since it is a programmatic flaw.

we are extracting nonce from params in https://github.com/nuxt-community/auth-module/blob/v4.9.1/lib/schemes/oauth2.js#L82

However, we are setting nonce only if response_type is id_token as you pointed out.

My expectation was setting nonce through params however because of above-explained logic nonce cannot be set through params unless response_type is id_token.

Let me know, if you agree with me or not.

[jkupcho]

Yeah I think that makes sense. Are you seeing flows where the nonce is necessary outside of id_token?

[gagandeep]

Keycloak has nonce enabled for token also. Default value of nonce usage in Keycloak is true.

useNonce - Adds a cryptographic nonce to verify that the authentication response matches the request (default is true).
https://www.keycloak.org/docs/latest/securing_apps/#methods

[JoaoPedroAS51]

Hi @gagandeep! I'm so sorry for the delay. Thank you for your PR! Nice work 😃

Just left a comment :)