unarchivedObjectOfClass OIDAuthState returns nil

[vineethnkforios]

Describe the bug
OIDAuthState *authState = [NSKeyedUnarchiver unarchiveObjectWithData:archivedAuthState];

return result of OIDAuthState but this is deprecated and changed to

NSError *errRet1;
OIDAuthState *authState1 = [NSKeyedUnarchiver unarchivedObjectOfClass:[OIDAuthState class]
fromData:archivedAuthState error:&errRet1];

but returns nil

To Reproduce
Steps to reproduce the behavior:
NSError *errRet1;
OIDAuthState *authState1 = [NSKeyedUnarchiver unarchivedObjectOfClass:[OIDAuthState class]
fromData:archivedAuthState error:&errRet1];

Expected behavior
return result of OIDAuthState

Screenshots
If applicable, add screenshots to help explain your problem.

Environment

• Device: iPhone 13, ios sumulators etc
• OS: 14.1.1 (23B8
• Browser:

Additional context

in flie : OIDServiceConfiguration.m

Modified like below but it also not working.

OIDServiceDiscovery *discoveryDocument = [aDecoder decodeObjectOfClass:[OIDServiceDiscovery class] forKey:kDiscoveryDocumentKey];
to

OIDServiceDiscovery *discoveryDocument = [aDecoder decodeObjectOfClasses:[NSSet setWithObjects:[OIDServiceDiscovery class], [NSDictionary class], [NSArray class], nil]
forKey:kDiscoveryDocumentKey];

in flie : OIDServiceDiscovery.m

• (nullable instancetype)initWithCoder:(NSCoder *)aDecoder {
  NSError *error;
  NSSet *codingClasses = [NSSet setWithArray:@[ [NSDictionary class],[NSArray class] ]];
  NSDictionary *dictionary = [aDecoder decodeObjectOfClasses:codingClasses forKey:kDiscoveryDictionary];
  // NSDictionary *dictionary = [[NSDictionary alloc] initWithCoder:aDecoder];
  self = [self initWithDictionary:dictionary error:&error];
  if (error) {
  return nil;
  }
  return self;
  }

• (void)encodeWithCoder:(NSCoder *)aCoder {
  [aCoder encodeObject:_discoveryDictionary forKey:kDiscoveryDictionary];
  }

[mingyokim]

Sorry I was not able to reproduce on my end - I was able to decode/encode the OIDAuthState using NSKeyedArchiver/NSKeyedUnarchiver. Perhaps it would help for you to take a look at our example usage of encoding/decoding OIDAuthState? https://github.com/openid/AppAuth-iOS/blob/master/Examples/Example-iOS_ObjC/Source/AppAuthExampleViewController.m#L105-L122

[vineethnkforios]

@mingyokim
OIDAuthState *authState = [NSKeyedUnarchiver unarchiveObjectWithData:archivedAuthState];
This line is working for me too, but it is deprecated have to update, the Veracode scan detects as an issue.
So I tried like below

For Archive:
NSError *error = nil;
NSData *archivedAuthState = [NSKeyedArchiver archivedDataWithRootObject:_authState requiringSecureCoding:YES error:&error];
if (error) {
NSLog(@"Error archiving object: %@", error.localizedDescription);
return;
}

Status: Seems working fine

For Unarchive:
NSError *errRet1;
OIDAuthState *authState1 = [NSKeyedUnarchiver unarchivedObjectOfClass:[OIDAuthState class]
fromData:archivedAuthState error:&errRet1];

Status: Seems not working , getting nil value as output

Any solution ?

[Truba]

Hi I had a similar issue, unarchived was failing and it was not obvious why.
Server was returning null for refresh token in refresh_token grant_type:

{
    "access_token": "......",
    "refresh_token": null,
    "expires_in": ....,
    "token_type": "Bearer"
} 

And the issue I faced was that OIDTokenResponse encoded it as NSNull which then broke the unarchived.
This fix was on the server, but it might be that one of the responses is returning null for something which is braking the unarchived.

---

For the maintainers, can we please filter NSNull out before archiving form all the additionalParameters that are being saved?

[mingyokim]

@vineethnkforios I tried using archivedDataWithRootObject:requiringSecureCoding:error: as well, but I was still not able to reproduce your error. It works on my end.

// encoding
NSData *archivedAuthState = [NSKeyedArchiver archivedDataWithRootObject:_authState requiringSecureCoding:YES error:nil];
// decoding
OIDAuthState *authState = [NSKeyedUnarchiver unarchivedObjectOfClass:[OIDAuthState class] fromData:archivedAuthState error:nil];

@Truba NSNull conforms to NSSecureCoding (documentation), which means it is archivable/unarchivable. I'm not sure if I follow how NSNull would break the archiving/unarchiving process. But @vineethnkforios, maybe you should try:

OIDAuthState *authState = [NSKeyedUnarchiver unarchivedObjectOfClasses:@[[OIDAuthState class], [NSNull class]] fromData:archivedAuthState error:nil]

[Truba]

Hi @mingyokim
I'm sorry.
Let me provide more context:

Test code ment to crash if something fails:

try! NSKeyedUnarchiver.unarchivedObject(ofClasses: [OIDAuthState.self, NSNull.self], from: data) as? OIDAuthState

Crash:

Fatal error: 'try!' expression unexpectedly raised an error: Error Domain=NSCocoaErrorDomain Code=4864 "value for key 'NS.objects' was of unexpected class 'NSNull' (0x1ee10c708) [/System/Library/Frameworks/CoreFoundation.framework].
Allowed classes are:
 {(
    "'NSString' (0x1ee114968) [/System/Library/Frameworks/Foundation.framework]",
    "'NSNumber' (0x1ee1148f0) [/System/Library/Frameworks/Foundation.framework]",
    "'NSArray' (0x1ee10cc58) [/System/Library/Frameworks/CoreFoundation.framework]",
    "'NSDictionary' (0x1ee10cb18) [/System/Library/Frameworks/CoreFoundation.framework]"
)}" UserInfo={NSDebugDescription=value for key 'NS.objects' was of unexpected class 'NSNull' (0x1ee10c708) [/System/Library/Frameworks/CoreFoundation.framework].
Allowed classes are:
 {(
    "'NSString' (0x1ee114968) [/System/Library/Frameworks/Foundation.framework]",
    "'NSNumber' (0x1ee1148f0) [/System/Library/Frameworks/Foundation.framework]",
    "'NSArray' (0x1ee10cc58) [/System/Library/Frameworks/CoreFoundation.framework]",
    "'NSDictionary' (0x1ee10cb18) [/System/Library/Frameworks/CoreFoundation.framework]"
)}}

By removing NSNull from additionalParameters from OIDTokenResponse it stopped crashing.

---

Where I think the issue is, in OIDTokenResponse:

- (nullable instancetype)initWithCoder:(NSCoder *)aDecoder {
  OIDTokenRequest *request =
      [aDecoder decodeObjectOfClass:[OIDTokenRequest class] forKey:kRequestKey];
  self = [self initWithRequest:request parameters:@{ }];
  if (self) {
    [OIDFieldMapping decodeWithCoder:aDecoder map:[[self class] fieldMap] instance:self];
    _additionalParameters = [aDecoder decodeObjectOfClasses:[OIDFieldMapping JSONTypes]
                                                     forKey:kAdditionalParametersKey];
  }
  return self;
}

[OIDFieldMapping JSONTypes] doesn't contain NSNull

My first thought was to filter out NSNull out of the additionalParameters in the library, but maybe just adding NSNull to the [OIDFieldMapping JSONTypes] could be a better option.

[mingyokim]

Thank you @Truba , created #905

[mingyokim]

Hi @Truba, on second thought may I ask 1) why is refresh_token in additionalParameters and 2) why your issuer is returning null for refresh_token? The documentation states that:

Omitted parameters and parameters with no value SHOULD be omitted from the object and not represented by a JSON null value, unless otherwise specified.

[Truba]

Hi @mingyokim

Thank you.

In my case it was our server's error, I was getting refresh_token: null in the oauth2/token response for refresh token grant. Since the request is done from inside the library I wasn't able to omit the null value on the iOS side and needed to wait for the server to fix their error.

If this is not allowed by the specification, I'm also ok with the solution of throwing an exception if there is a NSNull value present where it should not be. I wasn't aware of the specification, and spent quite some time debugging what is going on.

[mingyokim]

Thank you for your response, @Truba. We will move forward with not allowing null refresh tokens, which aligns with the specifications. Please make sure the issuer does not return JSON objects with null fields.