omniauth-google-oauth2 1.2.2 → 1.2.3

data/spec/omniauth/strategies/google_oauth2_spec.rb

@@ -3,6 +3,7 @@
 require 'spec_helper'
 require 'json'
 require 'omniauth-google-oauth2'
+require 'openssl'
 require 'stringio'
 
 describe OmniAuth::Strategies::GoogleOauth2 do
@@ -23,6 +24,8 @@ describe OmniAuth::Strategies::GoogleOauth2 do
 
   before do
     OmniAuth.config.test_mode = true
+    # The key set is cached on the class, so it must not leak between examples.
+    OmniAuth::Strategies::GoogleOauth2.reset_jwks_cache!
   end
 
   after do
@@ -442,6 +445,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
             {
               'abc' => 'xyz',
               'exp' => Time.now.to_i + 3600,
+              'sub' => '12345',
               'nbf' => Time.now.to_i - 60,
               'iat' => Time.now.to_i,
               'aud' => 'appid',
@@ -449,7 +453,9 @@ describe OmniAuth::Strategies::GoogleOauth2 do
             }
           end
           let(:id_token) { JWT.encode(token_info, 'secret') }
-          let(:access_token) { OAuth2::AccessToken.from_hash(client, 'id_token' => id_token) }
+          let(:access_token) do
+            OAuth2::AccessToken.from_hash(client, 'access_token' => 'valid_access_token', 'id_token' => id_token)
+          end
 
           it 'should include id_token when set on the access_token' do
             expect(subject.extra).to include(id_token: id_token)
@@ -468,6 +474,14 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           it 'should include id_info when id_token is set on the access_token by default' do
             expect(subject.extra).to include(id_info: token_info)
           end
+
+          it 'decodes the token only once across repeated extra calls' do
+            allow(JWT).to receive(:decode).and_call_original
+
+            2.times { subject.extra }
+
+            expect(JWT).to have_received(:decode).once
+          end
         end
       end
 
@@ -479,6 +493,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           {
             'abc' => 'xyz',
             'exp' => Time.now.to_i + 3600,
+            'sub' => '12345',
             'nbf' => Time.now.to_i - 60,
             'iat' => Time.now.to_i,
             'aud' => 'appid',
@@ -486,16 +501,71 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           }
         end
         let(:id_token) { JWT.encode(token_info, 'secret') }
-        let(:access_token) { OAuth2::AccessToken.from_hash(client, 'id_token' => id_token) }
+        let(:access_token) do
+          OAuth2::AccessToken.from_hash(client, 'access_token' => 'valid_access_token', 'id_token' => id_token)
+        end
 
         it 'raises JWT::InvalidIssuerError' do
           expect { subject.extra }.to raise_error(JWT::InvalidIssuerError)
         end
       end
 
+      # Reaching extra without going through verified_id_token, so the claim
+      # cache is empty and extra does the audience check itself. This is the
+      # multi-platform case: a token minted for a sibling client id.
+      context 'when the id_token is minted for an authorized client' do
+        let(:token_info) do
+          {
+            'exp' => Time.now.to_i + 3600,
+            'sub' => '12345',
+            'nbf' => Time.now.to_i - 60,
+            'iat' => Time.now.to_i,
+            'aud' => 'android-client-id',
+            'iss' => 'https://accounts.google.com'
+          }
+        end
+        let(:id_token) { JWT.encode(token_info, 'secret') }
+        let(:access_token) do
+          OAuth2::AccessToken.from_hash(client, 'access_token' => 'valid_access_token', 'id_token' => id_token)
+        end
+
+        it 'decodes it when that client is configured' do
+          # Built here rather than through `subject`, because the enclosing
+          # before hook instantiates the strategy before an example body runs.
+          strategy = described_class.new(app, 'appid', 'secret', authorized_client_ids: ['android-client-id'])
+          allow(strategy).to receive_messages(request: request, access_token: access_token)
+
+          expect(strategy.extra[:id_info]).to include('aud' => 'android-client-id')
+        end
+
+        it 'rejects it when that client is not configured' do
+          expect { subject.extra }.to raise_error(JWT::InvalidAudError)
+        end
+      end
+
+      # Also reached with an empty claim cache, so extra applies the requirement
+      # itself. A claim check passes silently when the claim is absent, so
+      # without this an id_token carrying no exp would never expire.
+      context 'when the id_token omits a required claim' do
+        let(:token_info) do
+          {
+            'exp' => Time.now.to_i + 3600,
+            'aud' => 'appid',
+            'iss' => 'https://accounts.google.com'
+          }
+        end
+        let(:id_token) { JWT.encode(token_info, 'secret') }
+        let(:access_token) do
+          OAuth2::AccessToken.from_hash(client, 'access_token' => 'valid_access_token', 'id_token' => id_token)
+        end
+
+        it 'raises rather than exposing the remaining claims' do
+          expect { subject.extra }.to raise_error(JWT::MissingRequiredClaim, /sub/)
+        end
+      end
+
       context 'when the access token is empty or nil' do
         let(:access_token) { OAuth2::AccessToken.new(client, nil, { 'refresh_token' => 'foo' }) }
-        before { allow(subject.extra).to receive(:access_token).and_return(access_token) }
 
         it 'should not include id_token' do
           expect(subject.extra).not_to have_key(:id_token)
@@ -505,6 +575,14 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           expect(subject.extra).not_to have_key(:id_info)
         end
       end
+
+      context 'when the access token does not include an id_token' do
+        let(:access_token) { OAuth2::AccessToken.from_hash(client, 'access_token' => 'opaque_access_token') }
+
+        it 'does not treat the opaque access token as an id_token' do
+          expect(subject.extra).not_to include(:id_token, :id_info)
+        end
+      end
     end
 
     describe 'raw_info' do
@@ -512,6 +590,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
         {
           'abc' => 'xyz',
           'exp' => Time.now.to_i + 3600,
+          'sub' => '12345',
           'nbf' => Time.now.to_i - 60,
           'iat' => Time.now.to_i,
           'aud' => 'appid',
@@ -723,6 +802,21 @@ describe OmniAuth::Strategies::GoogleOauth2 do
   end
 
   describe 'build_access_token' do
+    # Stands in for what the token endpoint really hands back; a bare stub would
+    # return nil, which the strategy now rejects as "no credential".
+    let(:stubbed_token) { double('AccessToken') }
+
+    # Mimics a Rack 3 input stream: readable, but deliberately not rewindable.
+    # A strict double fails the example if anything calls rewind on it.
+    def non_rewindable_input(content)
+      io = StringIO.new(content)
+      double('Rack3Input').tap do |input|
+        allow(input).to receive(:read) { |*args| io.read(*args) }
+        allow(input).to receive(:gets) { io.gets }
+        allow(input).to receive(:each) { |&block| io.each(&block) }
+      end
+    end
+
     it 'should use a hybrid authorization request_uri if this is an AJAX request with a code parameter' do
       allow(request).to receive(:xhr?).and_return(true)
       allow(request).to receive(:params).and_return('code' => 'valid_code')
@@ -731,9 +825,8 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       auth_code = double(:auth_code)
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'postmessage' }, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'postmessage' }, {}).and_return(stubbed_token)
 
-      expect(subject).not_to receive(:orig_build_access_token)
       subject.build_access_token
     end
 
@@ -745,9 +838,8 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       auth_code = double(:auth_code)
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: '' }, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: '' }, {}).and_return(stubbed_token)
 
-      expect(subject).not_to receive(:orig_build_access_token)
       subject.build_access_token
     end
 
@@ -759,13 +851,12 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       auth_code = double(:auth_code)
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri' }, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri' }, {}).and_return(stubbed_token)
 
-      expect(subject).not_to receive(:orig_build_access_token)
       subject.build_access_token
     end
 
-    it 'should read access_token from hash if this is not an AJAX request with a code parameter' do
+    it 'should read only access_token from params if this is not an AJAX request with a code parameter' do
       client = OAuth2::Client.new('abc', 'def') do |builder|
         builder.request :url_encoded
         builder.adapter :test do |stub|
@@ -774,18 +865,29 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       end
 
       allow(request).to receive(:xhr?).and_return(false)
-      allow(request).to receive(:params).and_return('access_token' => 'valid_access_token')
+      allow(request).to receive(:params).and_return(
+        'access_token' => 'valid_access_token',
+        'id_token' => 'forged_id_token',
+        'refresh_token' => 'forged_refresh_token',
+        'expires_at' => 123_456_789
+      )
       expect(subject).to receive(:verify_token).with('valid_access_token').and_return true
       expect(subject).to receive(:client).and_return(client)
+      allow(subject).to receive(:warn)
 
       token = subject.build_access_token
       expect(token).to be_instance_of(OAuth2::AccessToken)
       expect(token.token).to eq('valid_access_token')
       expect(token.client).to eq(client)
+      expect(token.params).to be_empty
+      expect(token.refresh_token).to be_nil
+      expect(token.expires_at).to be_nil
     end
 
     it 'reads the code from a json request body' do
-      body = StringIO.new(%({"code":"json_access_token"}))
+      # Literal UTF-8 rather than JSON.dump, which would escape the accent back to ASCII.
+      payload = %({"code":"json_access_token","note":"café"})
+      body = non_rewindable_input(payload)
       client = double(:client)
       auth_code = double(:auth_code)
 
@@ -795,9 +897,12 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
 
-      expect(auth_code).to receive(:get_token).with('json_access_token', { redirect_uri: 'postmessage' }, {})
+      expect(auth_code).to receive(:get_token).with('json_access_token', { redirect_uri: 'postmessage' }, {}).and_return(stubbed_token)
 
       subject.build_access_token
+
+      expect(request.env['rack.input']).to be_a(StringIO)
+      expect(request.env['rack.input'].read.b).to eq(payload.b)
     end
 
     it 'reads the redirect uri from a json request body' do
@@ -811,13 +916,18 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       allow(client).to receive(:auth_code).and_return(auth_code)
       expect(subject).to receive(:client).and_return(client)
 
-      expect(auth_code).to receive(:get_token).with('json_access_token', { redirect_uri: 'sample' }, {})
+      expect(auth_code).to receive(:get_token).with('json_access_token', { redirect_uri: 'sample' }, {}).and_return(stubbed_token)
 
       subject.build_access_token
     end
 
-    it 'reads the access token from a json request body' do
-      body = StringIO.new(%({"access_token":"valid_access_token"}))
+    it 'reads only the access token from a json request body' do
+      body = StringIO.new(JSON.dump(
+                            access_token: 'valid_access_token',
+                            id_token: 'forged_id_token',
+                            refresh_token: 'forged_refresh_token',
+                            expires_at: 123_456_789
+                          ))
       client = OAuth2::Client.new('abc', 'def') do |builder|
         builder.request :url_encoded
         builder.adapter :test do |stub|
@@ -829,6 +939,7 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       allow(request).to receive(:content_type).and_return('application/json')
       allow(request).to receive(:body).and_return(body)
       expect(subject).to receive(:client).and_return(client)
+      allow(subject).to receive(:warn)
 
       expect(subject).to receive(:verify_token).with('valid_access_token').and_return true
 
@@ -836,17 +947,52 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       expect(token).to be_instance_of(OAuth2::AccessToken)
       expect(token.token).to eq('valid_access_token')
       expect(token.client).to eq(client)
+      expect(token.params).to be_empty
+      expect(token.refresh_token).to be_nil
+      expect(token.expires_at).to be_nil
     end
 
     it 'should handle a malformed json request body gracefully' do
-      body = StringIO.new('not valid json{{{')
+      payload = 'not valid json{{{'
+      body = non_rewindable_input(payload)
 
       allow(request).to receive(:xhr?).and_return(false)
       allow(request).to receive(:params).and_return({})
       allow(request).to receive(:content_type).and_return('application/json')
       allow(request).to receive(:body).and_return(body)
 
-      expect { subject.build_access_token }.to output(/JSON parse error/).to_stderr
+      # Warns about the body, then fails as a normal auth failure rather than
+      # handing a nil token to the caller.
+      expect do
+        expect { subject.build_access_token }.to raise_error(OmniAuth::Strategies::OAuth2::CallbackError)
+      end.to output(/JSON parse error/).to_stderr
+
+      # The body is restored for downstream middlewares even when parsing fails.
+      expect(request.env['rack.input'].read.b).to eq(payload.b)
+    end
+
+    it 'fails cleanly when the request carries no usable credential' do
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:params).and_return('id_token' => 'an-id-token-with-no-access-token')
+      allow(request).to receive(:content_type).and_return(nil)
+
+      # The reason matters: verify_hd raises the same class, and applications
+      # branch on the message OmniAuth puts in the failure redirect.
+      expect { subject.build_access_token }.to raise_error(
+        OmniAuth::Strategies::OAuth2::CallbackError, /invalid_credentials.*No valid credentials/
+      )
+    end
+
+    [['a JSON array', '[1,2,3]'], ['a JSON number', '42'], ['a JSON string', '"nope"']].each do |label, payload|
+      it "fails cleanly when the JSON body is #{label} rather than an object" do
+        allow(request).to receive(:xhr?).and_return(false)
+        allow(request).to receive(:params).and_return({})
+        allow(request).to receive(:content_type).and_return('application/json')
+        allow(request).to receive(:body).and_return(non_rewindable_input(payload))
+
+        # Indexing a non-Hash by string would raise TypeError out of the callback.
+        expect { subject.build_access_token }.to raise_error(OmniAuth::Strategies::OAuth2::CallbackError)
+      end
     end
 
     it 'should use callback_url without query_string if this is not an AJAX request' do
@@ -860,8 +1006,413 @@ describe OmniAuth::Strategies::GoogleOauth2 do
       allow(subject).to receive(:callback_url).and_return('redirect_uri_without_query_string')
 
       expect(subject).to receive(:client).and_return(client)
-      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri_without_query_string' }, {})
+      expect(auth_code).to receive(:get_token).with('valid_code', { redirect_uri: 'redirect_uri_without_query_string' }, {}).and_return(stubbed_token)
+      subject.build_access_token
+    end
+  end
+
+  describe 'client-supplied id_token verification' do
+    # Generated once: RSA keygen is slow and the key is immutable across examples.
+    signing_key = OpenSSL::PKey::RSA.generate(2048)
+
+    # Exposed through a let so the helper methods below can reach it; a bare
+    # local is out of scope inside a def.
+    let(:key) { signing_key }
+    let(:jwks_status) { 200 }
+    let(:jwks_body) do
+      JSON.dump('keys' => [JWT::JWK.new(key, { kid: 'test-key', use: 'sig', alg: 'RS256' }).export])
+    end
+    let(:claims) do
+      { 'iss' => 'https://accounts.google.com', 'aud' => 'appid', 'sub' => '12345',
+        'email' => 'john@example.com', 'email_verified' => true,
+        'exp' => Time.now.to_i + 3600, 'nbf' => Time.now.to_i - 60 }
+    end
+    let(:genuine_id_token) { signed(claims) }
+    let(:jwks_response) { jwks_body }
+    let(:client) do
+      OAuth2::Client.new('appid', 'secret', site: 'https://www.googleapis.com') do |builder|
+        builder.request :url_encoded
+        builder.adapter :test do |stub|
+          stub.get('/oauth2/v3/certs') do
+            jwks_status == 200 ? [200, { 'content-type' => 'application/json' }, jwks_response] : [jwks_status, {}, 'upstream error']
+          end
+          stub.get('/oauth2/v3/userinfo') { [200, { 'content-type' => 'application/json' }, '{"sub":"12345"}'] }
+        end
+      end
+    end
+
+    def signed(payload)
+      JWT.encode(payload, key, 'RS256', { kid: 'test-key' })
+    end
+
+    def build_token(id_token)
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:params).and_return(
+        'access_token' => 'valid_access_token', 'id_token' => id_token,
+        'refresh_token' => 'forged_refresh_token', 'expires_at' => 123_456_789
+      )
+      allow(subject).to receive(:verify_token).with('valid_access_token').and_return(true)
+      allow(subject).to receive(:client).and_return(client)
+      allow(subject).to receive(:warn)
+      subject.build_access_token
+    end
+
+    it 'keeps an id_token that Google actually signed' do
+      expect(build_token(genuine_id_token)['id_token']).to eq(genuine_id_token)
+    end
+
+    it 'exposes the verified claims as id_info' do
+      subject.access_token = build_token(genuine_id_token)
+      expect(subject.extra[:id_info]['email']).to eq('john@example.com')
+    end
+
+    it 'decodes a caller-supplied id_token only once' do
+      allow(JWT).to receive(:decode).and_call_original
+
+      subject.access_token = build_token(genuine_id_token)
+      subject.extra
+
+      expect(JWT).to have_received(:decode).once
+    end
+
+    it 'does not revalidate a caller-supplied id_token during extra processing' do
+      now = Time.now
+      allow(Time).to receive(:now).and_return(now)
+      expiring = signed(claims.merge('exp' => now.to_i + 1))
+      subject.access_token = build_token(expiring)
+
+      allow(Time).to receive(:now).and_return(now + 3600)
+
+      expect(subject.extra[:id_info]).to include('sub' => '12345')
+    end
+
+    it 'keeps an id_token minted for an authorized client' do
+      subject.options.authorized_client_ids = ['mobile-client']
+      authorized = signed(claims.merge('aud' => 'mobile-client'))
+
+      subject.access_token = build_token(authorized)
+
+      expect(subject.extra).to include(
+        id_token: authorized,
+        id_info: hash_including('aud' => 'mobile-client')
+      )
+    end
+
+    it 'keeps an authorized-client id_token when JWT output is skipped' do
+      subject.options.authorized_client_ids = ['mobile-client']
+      subject.options.skip_jwt = true
+      authorized = signed(claims.merge('aud' => 'mobile-client'))
+
+      subject.access_token = build_token(authorized)
+
+      expect(subject.extra).to include(id_token: authorized)
+      expect(subject.extra).not_to have_key(:id_info)
+    end
+
+    # These carry a kid that IS in the key set, so they reach the algorithm check
+    # rather than being turned away earlier at key lookup. Without the kid they
+    # would pass even if the RS256 pin were removed.
+    it 'discards an unsigned id_token' do
+      forged = JWT.encode(claims.merge('email' => 'victim@example.com'), nil, 'none', { kid: 'test-key' })
+      expect(build_token(forged)['id_token']).to be_nil
+    end
+
+    it 'discards an id_token signed with a symmetric algorithm' do
+      forged = JWT.encode(claims.merge('email' => 'victim@example.com'), 'guessed-secret', 'HS256', { kid: 'test-key' })
+      expect(build_token(forged)['id_token']).to be_nil
+    end
+
+    it 'discards an id_token signed with the public key as an HMAC secret' do
+      forged = JWT.encode(claims.merge('email' => 'victim@example.com'), key.public_key.to_pem, 'HS256', { kid: 'test-key' })
+      expect(build_token(forged)['id_token']).to be_nil
+    end
+
+    # Each claim check passes silently when the claim is simply missing, so
+    # without a required list a token with no exp would never expire.
+    described_class::REQUIRED_ID_TOKEN_CLAIMS.each do |claim|
+      it "discards an id_token with no #{claim} claim" do
+        incomplete = signed(claims.reject { |k, _| k == claim })
+        expect(build_token(incomplete)['id_token']).to be_nil
+      end
+    end
+
+    it 'discards an id_token that is not yet valid' do
+      expect(build_token(signed(claims.merge('nbf' => Time.now.to_i + 3600)))['id_token']).to be_nil
+    end
+
+    it 'discards an id_token signed by an unknown key' do
+      stranger = OpenSSL::PKey::RSA.generate(2048)
+      forged = JWT.encode(claims, stranger, 'RS256', { kid: 'test-key' })
+      expect(build_token(forged)['id_token']).to be_nil
+    end
+
+    it 'discards an id_token minted for another audience' do
+      expect(build_token(signed(claims.merge('aud' => 'someone-elses-app')))['id_token']).to be_nil
+    end
+
+    it 'discards an id_token from an untrusted issuer' do
+      expect(build_token(signed(claims.merge('iss' => 'https://evil.example.com')))['id_token']).to be_nil
+    end
+
+    it 'discards an expired id_token' do
+      expect(build_token(signed(claims.merge('exp' => Time.now.to_i - 3600)))['id_token']).to be_nil
+    end
+
+    # jwt builds "Could not find public key for kid <caller's kid>", so the
+    # message quotes the request and could otherwise forge log records.
+    it 'keeps a hostile kid header to a single bounded log line' do
+      hostile = JWT.encode(claims, key, 'RS256', { kid: "evil\nFORGED LOG LINE\r\nAND ANOTHER#{'x' * 500}" })
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:params).and_return(
+        'access_token' => 'valid_access_token', 'id_token' => hostile
+      )
+      allow(subject).to receive(:verify_token).with('valid_access_token').and_return(true)
+      allow(subject).to receive(:client).and_return(client)
+
+      warnings = []
+      allow(subject).to receive(:warn) { |line| warnings << line }
+      subject.build_access_token
+
+      expect(warnings.size).to eq(1)
+      expect(warnings.first).not_to include("\n", "\r")
+      expect(warnings.first.length).to be <= described_class::LOG_MESSAGE_LIMIT + 80
+    end
+
+    it 'refetches the key set when a token names a key it does not hold' do
+      # Exercised through a real id_token rather than by calling the cache
+      # directly, so the wiring from the decoder's invalidate hook is covered:
+      # without it a rotated Google key would never be picked up.
+      fetches = 0
+      counting_client = OAuth2::Client.new('appid', 'secret', site: 'https://www.googleapis.com') do |builder|
+        builder.request :url_encoded
+        builder.adapter :test do |stub|
+          stub.get('/oauth2/v3/certs') do
+            fetches += 1
+            [200, { 'content-type' => 'application/json' }, jwks_body]
+          end
+          stub.get('/oauth2/v3/userinfo') { [200, { 'content-type' => 'application/json' }, '{"sub":"12345"}'] }
+        end
+      end
+
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:params).and_return(
+        'access_token' => 'valid_access_token',
+        'id_token' => JWT.encode(claims, key, 'RS256', { kid: 'rotated-key' })
+      )
+      allow(subject).to receive(:verify_token).with('valid_access_token').and_return(true)
+      allow(subject).to receive_messages(client: counting_client, warn: nil)
+
       subject.build_access_token
+
+      expect(fetches).to eq(2)
+    end
+
+    it 'still discards request-supplied refresh_token and expiry' do
+      token = build_token(genuine_id_token)
+      expect(token.refresh_token).to be_nil
+      expect(token.expires_at).to be_nil
+    end
+
+    # Precomputed with Base64.urlsafe_encode64 over 'valid_access_token' and
+    # 'another_access_token', pinning the strategy's pack-based encoding against
+    # an independent implementation. The userinfo stub above reports sub 12345,
+    # which is the subject the claims carry.
+    let(:at_hash_of_access_token) { 'CD6l-YB7vlH5uyYrxoiQtg' }
+    let(:at_hash_of_other_token) { 'ThOh39PmYAiHJ-oJozGU7A' }
+
+    it 'keeps an id_token whose at_hash matches the access token' do
+      bound = signed(claims.merge('at_hash' => at_hash_of_access_token))
+      expect(build_token(bound)['id_token']).to eq(bound)
+    end
+
+    # The example above cannot tell whether at_hash or the subject check accepted
+    # the token, because both agree. Here they disagree: a matching at_hash proves
+    # the pair was issued together, so it decides alone and userinfo is not
+    # consulted. Any error in the digest, its length, or its encoding fails this.
+    it 'accepts a matching at_hash on its own, without consulting userinfo' do
+      bound = signed(claims.merge('sub' => 'a-different-subject', 'at_hash' => at_hash_of_access_token))
+      expect(subject).not_to receive(:userinfo_for)
+
+      expect(build_token(bound)['id_token']).to eq(bound)
+    end
+
+    it 'keeps an id_token for the same user whose at_hash is stale' do
+      # A client that refreshed its access token but forwarded the id_token it
+      # was originally issued. Same person, so the subject check carries it.
+      skewed = signed(claims.merge('at_hash' => at_hash_of_other_token))
+      expect(build_token(skewed)['id_token']).to eq(skewed)
+    end
+
+    it 'discards an id_token for a different user than the access token' do
+      impostor = signed(claims.merge('sub' => 'someone-else', 'at_hash' => at_hash_of_other_token))
+      expect(build_token(impostor)['id_token']).to be_nil
+    end
+
+    it 'discards an id_token for a different user even with no at_hash to check' do
+      impostor = signed(claims.merge('sub' => 'someone-else'))
+      # Decoded, because `impostor` is the encoded JWT string and a plain
+      # include? on it would be a substring check over base64 text.
+      expect(JWT.decode(impostor, nil, false).first).not_to have_key('at_hash')
+      expect(build_token(impostor)['id_token']).to be_nil
+    end
+
+    it 'keeps a genuine id_token that carries no at_hash' do
+      expect(claims).not_to have_key('at_hash')
+      expect(build_token(genuine_id_token)['id_token']).to eq(genuine_id_token)
+    end
+
+    it 'checks the subject even when skip_info is set' do
+      @options = { skip_info: true }
+      impostor = signed(claims.merge('sub' => 'someone-else'))
+      expect(build_token(impostor)['id_token']).to be_nil
+    end
+
+    it 'discards the id_token when userinfo cannot be reached' do
+      allow_any_instance_of(OAuth2::AccessToken).to receive(:get).and_raise(OAuth2::Error.new(double(parsed: {}, body: '', headers: {}, status: 500)))
+      expect { build_token(genuine_id_token) }.not_to raise_error
+      expect(build_token(genuine_id_token)['id_token']).to be_nil
+    end
+
+    it 'verifies id_tokens for subclassed strategies too' do
+      subclass = Class.new(OmniAuth::Strategies::GoogleOauth2)
+      strategy = subclass.new(app, 'appid', 'secret').tap do |s|
+        allow(s).to receive(:request).and_return(request)
+        allow(s).to receive(:verify_token).with('valid_access_token').and_return(true)
+        allow(s).to receive(:client).and_return(client)
+      end
+      allow(request).to receive(:xhr?).and_return(false)
+      allow(request).to receive(:params).and_return(
+        'access_token' => 'valid_access_token', 'id_token' => genuine_id_token
+      )
+
+      expect(strategy.build_access_token['id_token']).to eq(genuine_id_token)
+    end
+
+    context 'when the key set cannot be fetched' do
+      let(:jwks_status) { 500 }
+
+      it 'discards the id_token rather than raising' do
+        expect { build_token(genuine_id_token) }.not_to raise_error
+      end
+
+      # The load-bearing assertion: an unreachable key set must never mean the
+      # token is taken on trust. Without this, failing open is invisible here.
+      it 'does not fall back to trusting an unverified id_token' do
+        expect(build_token(genuine_id_token)['id_token']).to be_nil
+      end
+
+      it 'still returns a usable access token' do
+        expect(build_token(genuine_id_token).token).to eq('valid_access_token')
+      end
+    end
+
+    # JWT::JWK::Set will build a key set out of surprising input rather than
+    # refusing it, including an HMAC key from a bare string, so the shape is
+    # checked before it gets there.
+    # The reason is asserted, not just the outcome: a malformed key set makes the
+    # token unverifiable whatever we do, so only the diagnostic distinguishes
+    # rejecting the shape from stumbling into a confusing error further down.
+    {
+      'a JSON array' => ['[1,2,3]', /not an object/],
+      'a JSON scalar' => ['42', /not an object/],
+      'an object with no keys entry' => ['{"nope":true}', /no keys array/],
+      'an object whose keys entry is a string' => ['{"keys":"nope"}', /no keys array/],
+      'a body that is not JSON at all' => ['<html>502 Bad Gateway</html>', /JSON::ParserError/]
+    }.each do |label, (malformed, reason)|
+      context "when the key set response is #{label}" do
+        let(:jwks_response) { malformed }
+
+        it 'discards the id_token and reports why' do
+          expect { build_token(genuine_id_token) }.not_to raise_error
+          expect(build_token(genuine_id_token)['id_token']).to be_nil
+          expect(subject).to have_received(:warn).with(reason).at_least(:once)
+        end
+      end
+    end
+  end
+
+  describe 'JWKS retrieval' do
+    it 'refetches when a token names a key it does not hold' do
+      # Key rotation has to resolve, so the first unknown kid forces a refresh.
+      attempts = 0
+      fetch = -> { attempts += 1 and :key_set }
+      described_class.cached_jwks(&fetch)
+      described_class.cached_jwks(force: true, &fetch)
+
+      expect(attempts).to eq(2)
+    end
+
+    it 'throttles forced refetches so unknown kids cannot drive them' do
+      # The sender picks the kid, so an unthrottled force is a way to make the
+      # process fetch on demand while holding the lock.
+      attempts = 0
+      fetch = -> { attempts += 1 and :key_set }
+      described_class.cached_jwks(&fetch)
+      10.times { described_class.cached_jwks(force: true, &fetch) }
+
+      expect(attempts).to eq(2)
+    end
+
+    # Subclassing the strategy is common, and reset_jwks_cache! is the documented
+    # test hook, so both class methods have to work from a subclass receiver.
+    context 'called on a subclass' do
+      let(:subclass) { Class.new(described_class) }
+
+      it 'shares the base class cache rather than keeping its own' do
+        fetched = subclass.cached_jwks { :shared_key_set }
+
+        expect(fetched).to eq(:shared_key_set)
+        expect(described_class.instance_variable_get(:@jwks)).to eq(:shared_key_set)
+      end
+
+      it 'clears the base class cache on reset' do
+        described_class.cached_jwks { :shared_key_set }
+
+        expect { subclass.reset_jwks_cache! }.not_to raise_error
+        expect(described_class.instance_variable_get(:@jwks)).to be_nil
+      end
+    end
+
+    it 'clears every piece of cached state on reset' do
+      described_class.cached_jwks { :key_set }
+      described_class.reset_jwks_cache!
+
+      %i[@jwks @jwks_expires_at @jwks_retry_at @jwks_forced_at].each do |ivar|
+        expect(described_class.instance_variable_get(ivar)).to be_nil
+      end
+    end
+
+    it 'backs off after a failed fetch even with nothing cached' do
+      attempts = 0
+      3.times do
+        expect do
+          described_class.cached_jwks do
+            attempts += 1
+            raise described_class::JwksUnavailable
+          end
+        end.to raise_error(described_class::JwksUnavailable)
+      end
+
+      expect(attempts).to eq(1)
+    end
+
+    it 'serves the stale key set and backs off when a refresh fails' do
+      described_class.cached_jwks { :cached_key_set }
+      described_class.instance_variable_set(:@jwks_expires_at, Time.now.to_i - 1)
+
+      attempts = 0
+      served = described_class.cached_jwks do
+        attempts += 1
+        raise SocketError, 'key endpoint unreachable'
+      end
+
+      expect(served).to eq(:cached_key_set)
+      expect(attempts).to eq(1)
+    end
+
+    it 'raises rather than returning nothing when the first fetch fails' do
+      expect { described_class.cached_jwks { raise SocketError, 'down at boot' } }
+        .to raise_error(SocketError)
     end
   end
 
@@ -884,6 +1435,12 @@ describe OmniAuth::Strategies::GoogleOauth2 do
           stub.post('/oauth2/v3/tokeninfo', 'access_token=invalid_access_token') do
             [400, { 'Content-Type' => 'application/json; charset=UTF-8' }, JSON.dump(error_description: 'Invalid Value')]
           end
+          stub.post('/oauth2/v3/tokeninfo', 'access_token=second_access_token') do
+            [200, { 'Content-Type' => 'application/json; charset=UTF-8' }, JSON.dump(
+              aud: 'another.apps.googleusercontent.com',
+              scope: 'https://www.googleapis.com/auth/drive'
+            )]
+          end
         end
       end
     end
@@ -911,6 +1468,18 @@ describe OmniAuth::Strategies::GoogleOauth2 do
         subject.send(:verify_token, 'invalid_access_token')
       end.to raise_error(OAuth2::Error)
     end
+
+    # One request can ask about more than one token: verify_token inspects the
+    # one from the request, while the credentials block later asks about the
+    # token the code exchange returned.
+    it 'looks each access token up on its own rather than reusing the first' do
+      expect(subject.send(:token_info, 'valid_access_token')['scope']).to eq('profile email')
+      expect(subject.send(:token_info, 'second_access_token')['scope']).to eq('https://www.googleapis.com/auth/drive')
+    end
+
+    it 'caches each token so a repeated lookup does not re-query' do
+      expect(subject.send(:token_info, 'valid_access_token')).to equal(subject.send(:token_info, 'valid_access_token'))
+    end
   end
 
   describe 'verify_hd' do