deno.land / x / oauth4webapi@v1.2.2 / test / authorization_code.test.ts
authorization_code.test.ts
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932import anyTest, { type TestFn } from 'ava'import { createPrivateKey } from 'node:crypto'import setup, { type Context, teardown, issuer, endpoint, client, getResponse, UA,} from './_setup.js'import * as jose from 'jose'import * as lib from '../src/index.js'
const test = anyTest as TestFn<Context & { [alg: string]: CryptoKeyPair }>
test.before(setup)test.after(teardown)
const algs: lib.JWSAlgorithm[] = ['RS256', 'ES256', 'PS256', 'EdDSA']
test.before(async (t) => { const keys = [] for (const alg of algs) { const key = await lib.generateKeyPair(alg, { extractable: true }) t.context[alg] = key keys.push(await crypto.subtle.exportKey('jwk', key.publicKey)) }
t.context .intercept({ path: '/jwks', method: 'GET', }) .reply(200, { keys })})
const tClient: lib.Client = { ...client, client_secret: 'foo' }
const callbackParameters = lib.validateAuthResponse( { issuer: 'foo' }, { client_id: 'foo' }, new URLSearchParams(), lib.expectNoState,)if (lib.isOAuth2Error(callbackParameters)) throw new Error()
function cb(arg: any): Exclude<ReturnType<typeof lib.validateAuthResponse>, lib.OAuth2Error> { // @ts-expect-error return new callbackParameters.constructor(arg)}
test('authorizationCodeGrantRequest()', async (t) => { await t.throwsAsync( lib.authorizationCodeGrantRequest( issuer, tClient, cb('code=authorization_code'), 'redirect_uri', 'verifier', ), { message: '"as.token_endpoint" must be a string', }, )
await t.throwsAsync( lib.authorizationCodeGrantRequest(issuer, tClient, <any>null, 'redirect_uri', 'verifier'), { message: '"callbackParameters" must be an instance of CallbackParameters obtained from "validateAuthResponse()", or "validateJwtAuthResponse()', }, )
await t.throwsAsync( lib.authorizationCodeGrantRequest( issuer, tClient, cb('code=authorization_code'), <any>null, 'verifier', ), { message: '"redirectUri" must be a non-empty string', }, )
await t.throwsAsync( lib.authorizationCodeGrantRequest( issuer, tClient, cb('code=authorization_code'), 'redirect_uri', <any>null, ), { message: '"codeVerifier" must be a non-empty string', }, )
await t.throwsAsync( lib.authorizationCodeGrantRequest(issuer, tClient, cb(''), 'redirect_uri', 'veirfier'), { message: 'no authorization code in "callbackParameters"', }, )
const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-1'), }
t.context .intercept({ path: '/token-1', method: 'POST', headers: { accept: 'application/json', 'user-agent': UA, }, body(body) { const params = new URLSearchParams(body) return ( params.get('grant_type') === 'authorization_code' && params.get('code') === 'authorization_code' && params.get('code_verifier') === 'verifier' && params.get('redirect_uri') === 'redirect_uri' ) }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync( lib.authorizationCodeGrantRequest( tIssuer, tClient, cb('code=authorization_code'), 'redirect_uri', 'verifier', ), )})
test('authorizationCodeGrantRequest() w/ Extra Parameters', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-2'), }
t.context .intercept({ path: '/token-2', method: 'POST', body(body) { const params = new URLSearchParams(body) return params.get('resource') === 'urn:example:resource' }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync( lib.authorizationCodeGrantRequest( tIssuer, tClient, cb('code=authorization_code'), 'redirect_uri', 'verifier', { additionalParameters: new URLSearchParams('resource=urn:example:resource'), }, ), )})
test('authorizationCodeGrantRequest() w/ Custom Headers', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-headers'), }
t.context .intercept({ path: '/token-headers', method: 'POST', headers: { accept: 'application/json', 'user-agent': 'foo', foo: 'bar', }, }) .reply(200, { access_token: 'token', token_type: 'Bearer' })
await t.notThrowsAsync( lib.authorizationCodeGrantRequest( tIssuer, tClient, cb('code=authorization_code'), 'redirect_uri', 'verifier', { headers: new Headers([ ['accept', 'will be overwritten'], ['user-agent', 'foo'], ['foo', 'bar'], ]), }, ), )})
test('authorizationCodeGrantRequest() w/ DPoP', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, token_endpoint: endpoint('token-3'), }
t.context .intercept({ path: '/token-3', method: 'POST', headers: { dpop: /.+/, }, }) .reply(200, { access_token: 'token', token_type: 'DPoP' })
const DPoP = t.context.ES256 await t.notThrowsAsync( lib.authorizationCodeGrantRequest( tIssuer, tClient, cb('code=authorization_code'), 'redirect_uri', 'verifier', { DPoP }, ), )})
test('processAuthorizationCodeOAuth2Response()', async (t) => { await t.throwsAsync(lib.processAuthorizationCodeOAuth2Response(issuer, client, <any>null), { message: '"response" must be an instance of Response', }) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response(issuer, client, getResponse('', { status: 404 })), { message: '"response" is not a conform Token Endpoint response', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response(issuer, client, getResponse('{"')), { message: 'failed to parse "response" body as JSON', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response(issuer, client, getResponse('null')), { message: '"response" body must be a top level object', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response(issuer, client, getResponse('[]')), { message: '"response" body must be a top level object', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ token_type: 'Bearer' })), ), { message: '"response" body "access_token" property must be a non-empty string', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ access_token: 'token' })), ), { message: '"response" body "token_type" property must be a non-empty string', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', expires_in: new Date().toUTCString(), }), ), ), { message: '"response" body "expires_in" property must be a positive number', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'unrecognized', expires_in: new Date().toUTCString(), }), ), ), { message: 'unsupported `token_type` value', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer', scope: null })), ), { message: '"response" body "scope" property must be a string', }, ) await t.throwsAsync( lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', refresh_token: null }), ), ), { message: '"response" body "refresh_token" property must be a non-empty string', }, ) for (const id_token of [null, 1, '', false, {}]) { t.deepEqual( await lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token })), ), { access_token: 'token', token_type: 'bearer', }, ) }
t.deepEqual( await lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', expires_in: 60, scope: 'api:read', refresh_token: 'refresh_token', }), ), ), { access_token: 'token', token_type: 'bearer', expires_in: 60, scope: 'api:read', refresh_token: 'refresh_token', }, )
t.true( lib.isOAuth2Error( await lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ error: 'invalid_grant' }), { status: 400 }), ), ), )
t.false( lib.isOAuth2Error( await lib.processAuthorizationCodeOAuth2Response( issuer, client, getResponse(JSON.stringify({ access_token: 'token', token_type: 'Bearer' })), ), ), )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token (alg signalled)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') } await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( issuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: 'id_token' }), ), ), { message: '"as.jwks_uri" must be a string', }, )
await t.notThrowsAsync( lib .processAuthorizationCodeOpenIDResponse( { ...tIssuer, id_token_signing_alg_values_supported: ['ES256'] }, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.ES256.privateKey), }), ), ) .then(async (result) => { if (lib.isOAuth2Error(result)) { t.fail() } else { t.assert(lib.getValidatedIdTokenClaims(result)) t.throws(() => lib.getValidatedIdTokenClaims({ ...result }), { name: 'TypeError', message: '"ref" was already garbage collected or did not resolve from the proper sources', }) } }), )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token (alg specified)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, { ...client, id_token_signed_response_alg: 'ES256' }, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.ES256.privateKey), }), ), ), )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token (alg default)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token (alg mismatches)', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.ES256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( { ...tIssuer, id_token_signing_alg_values_supported: ['RS256'], }, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.ES256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, { ...client, id_token_signed_response_alg: 'RS256' }, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'ES256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.ES256.privateKey), }), ), ), { message: 'unexpected JWT "alg" header parameter' }, )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token typ: "JWT"', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256', typ: 'JWT' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), )})
test('processAuthorizationCodeOpenIDResponse() with an ID Token typ: "application/jwt"', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256', typ: 'application/jwt' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), )})
for (const alg of algs) { test(`processAuthorizationCodeOpenIDResponse() with an ${alg} ID Token`, async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, id_token_signing_alg_values_supported: [alg], jwks_uri: endpoint('jwks'), }
let at_hash: string switch (alg) { case 'RS256': case 'PS256': case 'ES256': at_hash = 'xsZZrUssMXjL3FBlzoSh2g' break case 'EdDSA': at_hash = 'p2LHG4H-8pYDc0hyVOo3iIHvZJUqe9tbj3jESOuXbkY' break default: throw new Error('not implemented') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL', token_type: 'Bearer', id_token: await new jose.SignJWT({ at_hash }) .setProtectedHeader({ alg }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign( createPrivateKey({ key: await crypto.subtle .exportKey('pkcs8', t.context[alg].privateKey) .then(Buffer.from), format: 'der', type: 'pkcs8', }), ), }), ), ), ) })}
test('processAuthorizationCodeOpenIDResponse() with an ID Token w/ at_hash', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL-ar_qw5jl3lthwpMjm283aVMQXDmoqqqydDSqJfbhptzw8rUVwkuQbolw', token_type: 'Bearer', id_token: await new jose.SignJWT({ at_hash: 'x7vk7f6BvQj0jQHYFIk4ag', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), )
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL-ar_qw5jl3lthwpMjm283aVMQXDmoqqqydDSqJfbhptzw8rUVwkuQbolw', token_type: 'Bearer', id_token: await new jose.SignJWT({ at_hash: 'x7vk7f6BvQj0jQHYFIk4ag-invalid', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), { message: 'unexpected ID Token "at_hash" (access token hash) claim value' }, )})
test('processAuthorizationCodeOpenIDResponse() nonce checks', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({ nonce: 'randomvalue', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), { message: 'unexpected ID Token "nonce" claim value' }, )
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({ nonce: 'randomvalue', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), 'anotherrandom-value', ), { message: 'unexpected ID Token "nonce" claim value' }, )
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), 'anotherrandom-value', ), { message: 'ID Token "nonce" claim missing' }, )
for (const nonce of [null, '']) { await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), <any>nonce, ), { message: '"expectedNonce" must be a non-empty string', name: 'TypeError' }, ) }
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({ nonce: 'random-value' }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), 'random-value', ), )})
test('processAuthorizationCodeOpenIDResponse() auth_time checks', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, { ...client, require_auth_time: true, }, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({ auth_time: '0', }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience(client.client_id) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), { message: 'unexpected ID Token "auth_time" (authentication time) claim value' }, )})
test('processAuthorizationCodeOpenIDResponse() azp checks', async (t) => { const tIssuer: lib.AuthorizationServer = { ...issuer, jwks_uri: endpoint('jwks') }
await t.throwsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({}) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience([client.client_id, 'other-aud']) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), { message: 'unexpected ID Token "azp" (authorized party) claim value' }, )
await t.notThrowsAsync( lib.processAuthorizationCodeOpenIDResponse( tIssuer, client, getResponse( JSON.stringify({ access_token: 'token', token_type: 'Bearer', id_token: await new jose.SignJWT({ azp: client.client_id, }) .setProtectedHeader({ alg: 'RS256' }) .setIssuer(issuer.issuer) .setSubject('urn:example:subject') .setAudience([client.client_id, 'other-aud']) .setExpirationTime('5m') .setIssuedAt() .sign(t.context.RS256.privateKey), }), ), ), )})
oauth4webapi
Version Info
2 years ago
