@axa-fr/react-oidc 6.3.1 → 6.5.0-beta0

package/dist/vanilla/parseTokens.d.ts

@@ -2,4 +2,5 @@ export declare const setTokens: (tokens: any) => any;
 export declare const parseOriginalTokens: (tokens: any) => any;
 export declare const computeTimeLeft: (refreshTimeBeforeTokensExpirationInSecond: any, expiresAt: any) => number;
 export declare const isTokensValid: (tokens: any) => boolean;
+export declare const isTokensOidcValid: (tokens: any, nonce: any, oidcServerConfiguration: any) => boolean;
 //# sourceMappingURL=parseTokens.d.ts.map

package/dist/vanilla/parseTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseTokens.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/parseTokens.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,SAAS,sBAyBrB,CAAA;AAGD,eAAO,MAAM,mBAAmB,sBA+B/B,CAAA;AAED,eAAO,MAAM,eAAe,4EAG3B,CAAA;AAED,eAAO,MAAM,aAAa,0BAKzB,CAAA"}
+{"version":3,"file":"parseTokens.d.ts","sourceRoot":"","sources":["../../src/oidc/vanilla/parseTokens.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,SAAS,sBAyBrB,CAAA;AAID,eAAO,MAAM,mBAAmB,sBA+B/B,CAAA;AAED,eAAO,MAAM,eAAe,4EAG3B,CAAA;AAED,eAAO,MAAM,aAAa,0BAKzB,CAAA;AAID,eAAO,MAAM,iBAAiB,oEA2B7B,CAAA"}

package/dist/vanilla/parseTokens.js

@@ -11,7 +11,7 @@ var __assign = (this && this.__assign) || function () {
     return __assign.apply(this, arguments);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTokensValid = exports.computeTimeLeft = exports.parseOriginalTokens = exports.setTokens = void 0;
+exports.isTokensOidcValid = exports.isTokensValid = exports.computeTimeLeft = exports.parseOriginalTokens = exports.setTokens = void 0;
 var idTokenPayload = function (token) {
     if (!token) {
         return null;
@@ -57,7 +57,7 @@ var setTokens = function (tokens) {
     else {
         accessTokenPayload = extractAccessTokenPayload(tokens);
     }
-    var _idTokenPayload = idTokenPayload(tokens.idToken);
+    var _idTokenPayload = tokens.idTokenPayload ? tokens.idTokenPayload : idTokenPayload(tokens.idToken);
     var idTokenExipreAt = (_idTokenPayload && _idTokenPayload.exp) ? _idTokenPayload.exp : Number.MAX_VALUE;
     var accessTokenExpiresAt = (accessTokenPayload && accessTokenPayload.exp) ? accessTokenPayload.exp : tokens.issuedAt + tokens.expiresIn;
     var expiresAt = idTokenExipreAt < accessTokenExpiresAt ? idTokenExipreAt : accessTokenExpiresAt;
@@ -104,4 +104,33 @@ var isTokensValid = function (tokens) {
     return (0, exports.computeTimeLeft)(0, tokens.expiresAt) > 0;
 };
 exports.isTokensValid = isTokensValid;
+// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).
+// https://github.com/openid/AppAuth-JS/issues/65
+var isTokensOidcValid = function (tokens, nonce, oidcServerConfiguration) {
+    if (tokens.idTokenPayload) {
+        var idTokenPayload_1 = tokens.idTokenPayload;
+        // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.
+        if (oidcServerConfiguration.issuer !== idTokenPayload_1.iss) {
+            return false;
+        }
+        // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+        // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.
+        // 9: The current time MUST be before the time represented by the exp Claim.
+        var currentTimeUnixSecond = new Date().getTime() / 1000;
+        if (idTokenPayload_1.exp && idTokenPayload_1.exp < currentTimeUnixSecond) {
+            return false;
+        }
+        // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.
+        var timeInSevenDays = 60 * 60 * 24 * 7;
+        if (idTokenPayload_1.iat && (idTokenPayload_1.iat + timeInSevenDays) < currentTimeUnixSecond) {
+            return false;
+        }
+        // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.
+        if (idTokenPayload_1.nonce && idTokenPayload_1.nonce !== nonce) {
+            return false;
+        }
+    }
+    return true;
+};
+exports.isTokensOidcValid = isTokensOidcValid;
 //# sourceMappingURL=parseTokens.js.map

package/dist/vanilla/parseTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"parseTokens.js","sourceRoot":"","sources":["../../src/oidc/vanilla/parseTokens.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,IAAM,cAAc,GAAG,UAAC,KAAK;IACzB,IAAG,CAAC,KAAK,EAAC;QACN,OAAO,IAAI,CAAC;KACf;IACD,IAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QACzE,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC,CAAA;AAED,IAAM,WAAW,GAAG,UAAC,GAAG,EAAE,IAAI;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC,CAAA;AAED,IAAM,yBAAyB,GAAG,UAAA,MAAM;IACpC,IAAG,MAAM,CAAC,kBAAkB,EAC5B;QACI,OAAO,MAAM,CAAC,kBAAkB,CAAC;KACpC;IACD,IAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAG;QACC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACpD,OAAO,IAAI,CAAC;SACf;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACtD;IAAC,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACnB;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAGK,IAAM,SAAS,GAAG,UAAC,MAAM;IAE5B,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,IAAI,CAAC;KACf;IACD,IAAI,kBAAkB,CAAC;IAEvB,IAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjB,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;QACzD,MAAM,CAAC,QAAQ,GAAG,qBAAqB,CAAC;KAC3C;IAED,IAAG,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE;QACxC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAClD;SACI;QACD,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;KAC1D;IACD,IAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvD,IAAM,eAAe,GAAE,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAA,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACxG,IAAM,oBAAoB,GAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAC1I,IAAM,SAAS,GAAG,eAAe,GAAG,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAElG,6BAAW,MAAM,KAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,oBAAA,EAAE,SAAS,WAAA,IAAE;AACvF,CAAC,CAAA;AAzBY,QAAA,SAAS,aAyBrB;AAGM,IAAM,mBAAmB,GAAE,UAAC,MAAM;IACrC,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,IAAI,CAAC;KACf;IACD,IAAG,CAAC,MAAM,CAAC,SAAS,EAAE;QAClB,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;QACzD,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC;KAC5C;IAED,IAAM,IAAI,GAAG;QACT,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;IAGF,IAAG,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAC;QACvC,aAAa;QACb,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KACvD;IAED,IAAG,MAAM,CAAC,cAAc,KAAK,SAAS,EAAC;QACnC,aAAa;QACb,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;KAC/C;IAED,OAAO,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAA;AA/BY,QAAA,mBAAmB,uBA+B/B;AAEM,IAAM,eAAe,GAAG,UAAC,yCAAyC,EAAE,SAAS;IAChF,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,yCAAyC,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;AACzG,CAAC,CAAA;AAHY,QAAA,eAAe,mBAG3B;AAEM,IAAM,aAAa,GAAE,UAAC,MAAM;IAC/B,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,KAAK,CAAC;KAChB;IACD,OAAO,IAAA,uBAAe,EAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC,CAAA;AALY,QAAA,aAAa,iBAKzB"}
+{"version":3,"file":"parseTokens.js","sourceRoot":"","sources":["../../src/oidc/vanilla/parseTokens.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,IAAM,cAAc,GAAG,UAAC,KAAK;IACzB,IAAG,CAAC,KAAK,EAAC;QACN,OAAO,IAAI,CAAC;KACf;IACD,IAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QACzE,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEb,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC,CAAA;AAED,IAAM,WAAW,GAAG,UAAC,GAAG,EAAE,IAAI;IAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC,CAAA;AAED,IAAM,yBAAyB,GAAG,UAAA,MAAM;IACpC,IAAG,MAAM,CAAC,kBAAkB,EAC5B;QACI,OAAO,MAAM,CAAC,kBAAkB,CAAC;KACpC;IACD,IAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACvC,IAAG;QACC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACpD,OAAO,IAAI,CAAC;SACf;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACtD;IAAC,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACnB;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAGK,IAAM,SAAS,GAAG,UAAC,MAAM;IAE5B,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,IAAI,CAAC;KACf;IACD,IAAI,kBAAkB,CAAC;IAEvB,IAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjB,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;QACzD,MAAM,CAAC,QAAQ,GAAG,qBAAqB,CAAC;KAC3C;IAED,IAAG,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE;QACxC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KAClD;SACI;QACD,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;KAC1D;IACD,IAAM,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvG,IAAM,eAAe,GAAE,CAAC,eAAe,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAA,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACxG,IAAM,oBAAoB,GAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAC1I,IAAM,SAAS,GAAG,eAAe,GAAG,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAElG,6BAAW,MAAM,KAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,oBAAA,EAAE,SAAS,WAAA,IAAE;AACvF,CAAC,CAAA;AAzBY,QAAA,SAAS,aAyBrB;AAIM,IAAM,mBAAmB,GAAE,UAAC,MAAM;IACrC,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,IAAI,CAAC;KACf;IACD,IAAG,CAAC,MAAM,CAAC,SAAS,EAAE;QAClB,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;QACzD,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC;KAC5C;IAED,IAAM,IAAI,GAAG;QACT,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;IAGF,IAAG,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAC;QACvC,aAAa;QACb,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;KACvD;IAED,IAAG,MAAM,CAAC,cAAc,KAAK,SAAS,EAAC;QACnC,aAAa;QACb,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;KAC/C;IAED,OAAO,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAA;AA/BY,QAAA,mBAAmB,uBA+B/B;AAEM,IAAM,eAAe,GAAG,UAAC,yCAAyC,EAAE,SAAS;IAChF,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,yCAAyC,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;AACzG,CAAC,CAAA;AAHY,QAAA,eAAe,mBAG3B;AAEM,IAAM,aAAa,GAAE,UAAC,MAAM;IAC/B,IAAG,CAAC,MAAM,EAAC;QACP,OAAO,KAAK,CAAC;KAChB;IACD,OAAO,IAAA,uBAAe,EAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC,CAAA;AALY,QAAA,aAAa,iBAKzB;AAED,kJAAkJ;AAClJ,iDAAiD;AAC1C,IAAM,iBAAiB,GAAE,UAAC,MAAM,EAAE,KAAK,EAAE,uBAAuB;IACnE,IAAG,MAAM,CAAC,cAAc,EAAE;QACtB,IAAM,gBAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC7C,0JAA0J;QAC1J,IAAG,uBAAuB,CAAC,MAAM,KAAM,gBAAc,CAAC,GAAG,EAAC;YACtD,OAAO,KAAK,CAAC;SAChB;QACD,+YAA+Y;QAE/Y,gbAAgb;QAEhb,4EAA4E;QAC5E,IAAM,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAE,IAAI,CAAC;QACzD,IAAG,gBAAc,CAAC,GAAG,IAAI,gBAAc,CAAC,GAAG,GAAG,qBAAqB,EAAE;YACjE,OAAO,KAAK,CAAC;SAChB;QACD,6NAA6N;QAC7N,IAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAG,gBAAc,CAAC,GAAG,IAAI,CAAC,gBAAc,CAAC,GAAG,GAAG,eAAe,CAAC,GAAG,qBAAqB,EAAE;YACrF,OAAO,KAAK,CAAC;SAChB;QACD,+UAA+U;QAC/U,IAAI,gBAAc,CAAC,KAAK,IAAI,gBAAc,CAAC,KAAK,KAAK,KAAK,EAAE;YACxD,OAAO,KAAK,CAAC;SAChB;KACJ;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAA;AA3BY,QAAA,iBAAiB,qBA2B7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axa-fr/react-oidc",
-  "version": "6.3.1",
+  "version": "6.5.0-beta0",
   "private": false,
   "main": "dist/index.js",
   "jsnext:main": "dist/index.js",

package/src/oidc/ReactOidc.tsx

@@ -21,7 +21,7 @@ export const useOidc =(configurationName=defaultConfigurationName) =>{
         const oidc = getOidc(configurationName);
         setIsAuthenticated(defaultIsAuthenticated(getOidc, configurationName));
         const newSubscriptionId = oidc.subscriveEvents((name, data) => {
-            if(name === Oidc.eventNames.logout_from_another_tab || name === Oidc.eventNames.logout_from_same_tab){
+            if(name === Oidc.eventNames.logout_from_another_tab || name === Oidc.eventNames.logout_from_same_tab || name === Oidc.eventNames.token_aquired){
                 if(isMounted) {
                     setIsAuthenticated(defaultIsAuthenticated(getOidc, configurationName));
                 }
@@ -33,8 +33,8 @@ export const useOidc =(configurationName=defaultConfigurationName) =>{
         };
     }, [configurationName]);
 
-    const login = (callbackPath:string | undefined = undefined, extras:StringMap=null, state: string|undefined=undefined) => {
-        return getOidc(configurationName).loginAsync(callbackPath, extras, state);
+    const login = (callbackPath:string | undefined = undefined, extras:StringMap=null, state: string|undefined=undefined, silentLoginOnly = false) => {
+        return getOidc(configurationName).loginAsync(callbackPath, extras, state, false, undefined, silentLoginOnly);
     };
     const logout = (callbackPath: string | null | undefined = undefined, extras:StringMap=null) => {
         return getOidc(configurationName).logoutAsync(callbackPath, extras);

package/src/oidc/vanilla/OidcServiceWorker.js

@@ -20,6 +20,7 @@ let database = {
         tokens: null,
         status:null,
         items:[],
+        nonce: null,
         oidcServerConfiguration: null
     }
 };
@@ -56,6 +57,37 @@ const isTokensValid= (tokens) =>{
     return computeTimeLeft(0, tokens.expiresAt) > 0;
 }
 
+// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).
+// https://github.com/openid/AppAuth-JS/issues/65
+const isTokensOidcValid =(tokens, nonce, oidcServerConfiguration) =>{
+    if(tokens.idTokenPayload) {
+        const idTokenPayload = tokens.idTokenPayload;
+        // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.
+        if(oidcServerConfiguration.issuer !==  idTokenPayload.iss){
+            return false;
+        }
+        // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+
+        // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.
+
+        // 9: The current time MUST be before the time represented by the exp Claim.
+        const currentTimeUnixSecond = new Date().getTime() /1000;
+        if(idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {
+            return false;
+        }
+        // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.
+        const timeInSevenDays = 60 * 60 * 24 * 7;
+        if(idTokenPayload.iat && (idTokenPayload.iat + timeInSevenDays) < currentTimeUnixSecond) {
+            return false;
+        }
+        // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.
+        if (idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {
+            return false;
+        }
+    }
+    return true;
+}
+
 function hideTokens(currentDatabaseElement) {
     const configurationName = currentDatabaseElement.configurationName;
     return (response) => {
@@ -79,8 +111,12 @@ function hideTokens(currentDatabaseElement) {
             let _idTokenPayload = null;
             if(tokens.id_token) {
                 _idTokenPayload = extractTokenPayload(tokens.id_token);
+                tokens.idTokenPayload = {..._idTokenPayload};
+                if(_idTokenPayload.nonce) {
+                    const keyNonce = NONCE_TOKEN + '_'+ currentDatabaseElement.configurationName;
+                    _idTokenPayload.nonce = keyNonce;
+                }
                 secureTokens.idTokenPayload = _idTokenPayload;
-                tokens.idTokenPayload = _idTokenPayload;
             }
             if(tokens.refresh_token){
                 secureTokens.refresh_token = REFRESH_TOKEN + "_" + configurationName;
@@ -92,6 +128,10 @@ function hideTokens(currentDatabaseElement) {
             secureTokens.expiresAt = expiresAt;
             const body = JSON.stringify(secureTokens);
             tokens.expiresAt = expiresAt;
+
+            if(!isTokensOidcValid(tokens, currentDatabaseElement.nonce.nonce, currentDatabaseElement.oidcServerConfiguration)){
+                throw Error("Tokens are not OpenID valid");
+            }
             currentDatabaseElement.tokens = tokens;
             currentDatabaseElement.status = "LOGGED_IN";
             return new Response(body, response);
@@ -138,7 +178,7 @@ const getCurrentDatabaseDomain = (database, url) => {
             }
         }
 
-        if(hasToSendToken){
+        if(hasToSendToken) {
             if(!currentDatabase.tokens) {
                 return null;
             }
@@ -159,6 +199,7 @@ const serializeHeaders = (headers) => {
 
 const REFRESH_TOKEN = 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER';
 const ACCESS_TOKEN = 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER';
+const NONCE_TOKEN = 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER';
 
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 
@@ -215,11 +256,14 @@ const handleFetch = async (event) => {
                     let newBody = actualBody;
                     for(let i= 0;i<numberDatabase;i++){
                         const currentDb = currentDatabases[i];
-                        const key = REFRESH_TOKEN + '_'+ currentDb.configurationName;
-                        if(currentDb && currentDb.tokens != null && actualBody.includes(key)) {
-                            newBody = newBody.replace(key, encodeURIComponent(currentDb.tokens.refresh_token));
-                            currentDatabase = currentDb;
-                            break;
+
+                        if(currentDb && currentDb.tokens != null) {
+                            const keyRefreshToken = REFRESH_TOKEN + '_'+ currentDb.configurationName;
+                            if(actualBody.includes(keyRefreshToken)) {
+                                newBody = newBody.replace(keyRefreshToken, encodeURIComponent(currentDb.tokens.refresh_token));
+                                currentDatabase = currentDb;
+                                break;
+                            }
                         }
                     }
 
@@ -327,6 +371,8 @@ addEventListener('message', event => {
             checkDomain(domains, tokenEndpoint);
             const userInfoEndpoint = oidcServerConfiguration.userInfoEndpoint;
             checkDomain(domains, userInfoEndpoint);
+            const issuer = oidcServerConfiguration.issuer;
+            checkDomain(domains, issuer);
             currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
             const where = data.data.where;
             if(where === "loginCallbackAsync" || where === "tryKeepExistingSessionAsync") {
@@ -348,6 +394,9 @@ addEventListener('message', event => {
                 if(tokens.refresh_token){
                     tokens.refresh_token = REFRESH_TOKEN + "_" + configurationName;
                 }
+                if(tokens.idTokenPayload && tokens.idTokenPayload.nonce){
+                    tokens.idTokenPayload.nonce =  NONCE_TOKEN + "_" + configurationName;
+                }
                 port.postMessage({
                     tokens,
                     status: currentDatabase.status,
@@ -364,8 +413,12 @@ addEventListener('message', event => {
             const sessionState = currentDatabase.sessionState;
             port.postMessage({configurationName, sessionState});
             return;
+        case "setNonce":
+            currentDatabase.nonce = data.data.nonce;
+            port.postMessage({configurationName});
+            return;
         default:
-            currentDatabase.items = data.data;
+            currentDatabase.items = { ...data.data };
             port.postMessage({configurationName});
             return;
     }

package/src/oidc/vanilla/initSession.ts

@@ -35,13 +35,34 @@
         return storage[`oidc.session_state.${configurationName}:${redirectUri}`];
     }
 
+    const setNonceAsync = (nonce) => {
+        localStorage[`oidc.nonce.${configurationName}:${redirectUri}`] = nonce.nonce;
+    }
+
+    const getNonceAsync= async () => {
+        // @ts-ignore
+        const result =  {nonce: localStorage[`oidc.nonce.${configurationName}:${redirectUri}`]};
+        localStorage[`oidc.nonce.${configurationName}:${redirectUri}`] = "";
+        return result;
+    }
+
     const getTokens = () => {
-       
         if(!storage[`oidc.${configurationName}:${redirectUri}`]){
             return null;
         }
         return JSON.stringify({ tokens : JSON.parse(storage[`oidc.${configurationName}:${redirectUri}`]).tokens });
     }
 
-    return { saveItemsAsync, loadItemsAsync, clearAsync, initAsync, setTokens, getTokens, setSessionState, getSessionState };
+    return {
+        saveItemsAsync, 
+        loadItemsAsync, 
+        clearAsync, 
+        initAsync, 
+        setTokens, 
+        getTokens, 
+        setSessionState, 
+        getSessionState,
+        setNonceAsync,
+        getNonceAsync
+    };
 }

package/src/oidc/vanilla/initWorker.ts

@@ -138,6 +138,16 @@ export const initWorkerAsync = async(serviceWorkerRelativeUrl, configurationName
         return result.sessionState;
     }
 
+    const setNonceAsync = (nonce) => {
+        return sendMessageAsync(registration)({type: "setNonce", data: {nonce}, configurationName});
+    }
+    const NONCE_TOKEN = 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER';
+    const getNonceAsync= async () => {
+        // @ts-ignore
+        const keyNonce = NONCE_TOKEN + '_'+ configurationName;
+        return {nonce:keyNonce};
+    }
+
     return { 
         saveItemsAsync, 
         loadItemsAsync, 
@@ -148,6 +158,8 @@ export const initWorkerAsync = async(serviceWorkerRelativeUrl, configurationName
         isServiceWorkerProxyActiveAsync,
         setSessionStateAsync,
         getSessionStateAsync,
+        setNonceAsync,
+        getNonceAsync,
         unregisterAsync,
     };
 }

package/src/oidc/vanilla/oidc.ts

@@ -19,7 +19,7 @@ import timer from './timer';
 import {CheckSessionIFrame} from "./checkSessionIFrame"
 import {getParseQueryStringFromLocation} from "./route-utils";
 import {AuthorizationServiceConfigurationJson} from "@openid/appauth/src/authorization_service_configuration";
-import {computeTimeLeft, isTokensValid, parseOriginalTokens, setTokens} from "./parseTokens";
+import {computeTimeLeft, isTokensOidcValid, isTokensValid, parseOriginalTokens, setTokens} from "./parseTokens";
 
 const performTokenRequestAsync= async (url, details, extras) => {
     
@@ -80,10 +80,12 @@ const internalFetch = async (url, headers, numberRetry=0) => {
 
 export interface OidcAuthorizationServiceConfigurationJson extends AuthorizationServiceConfigurationJson{
     check_session_iframe?: string;
+    issuer:string;
 }
 
 export class OidcAuthorizationServiceConfiguration extends AuthorizationServiceConfiguration{
     private check_session_iframe: string;
+    private issuer: string;
     
     constructor(request: any) {
         super(request);
@@ -92,6 +94,7 @@ export class OidcAuthorizationServiceConfiguration extends AuthorizationServiceC
         this.revocationEndpoint = request.revocation_endpoint;
         this.userInfoEndpoint = request.userinfo_endpoint;
         this.check_session_iframe = request.check_session_iframe;
+        this.issuer = request.issuer;
     }
     
 }
@@ -113,6 +116,7 @@ export interface AuthorityConfiguration {
     end_session_endpoint?: string;
     userinfo_endpoint?: string;
     check_session_iframe?:string;
+    issuer:string;
 }
 
  export type OidcConfiguration = {
@@ -153,9 +157,12 @@ const loginCallbackWithAutoTokensRenewAsync = async (oidc) => {
 async function renewTokensAndStartTimerAsync(oidc, refreshToken, forceRefresh =false) {
     const {tokens, status} = await oidc.synchroniseTokensAsync(refreshToken, 0, forceRefresh);
     oidc.tokens = tokens;
-    if (!oidc.serviceWorker) {
-        await oidc.session.setTokens(oidc.tokens);
+    const serviceWorker = await initWorkerAsync(oidc.configuration.service_worker_relative_url, oidc.configurationName);
+    if (!serviceWorker) {
+        const session = initSession(this.configurationName, oidc.configuration.redirect_uri, oidc.configuration.storage);
+        await session.setTokens(oidc.tokens);
     }
+    
     if (!oidc.tokens) {
         await oidc.destroyAsync(status);
         return;
@@ -321,9 +328,9 @@ export class Oidc {
     public tokens: null;
     public events: Array<any>;
     private timeoutId: NodeJS.Timeout;
-    private serviceWorker?: any;
+    //private serviceWorker?: any;
     private configurationName: string;
-    private session?: any;
+    //private session?: any;
     private checkSessionIFrame: CheckSessionIFrame;
     constructor(configuration:OidcConfiguration, configurationName="default") {
         let silent_login_uri = configuration.silent_login_uri;
@@ -342,8 +349,8 @@ export class Oidc {
       this.userInfo = null;
       this.events = [];
       this.timeoutId = null;
-      this.serviceWorker = null;
-      this.session = null;
+      //this.serviceWorker = null;
+      //this.session = null;
       this.synchroniseTokensAsync.bind(this);
       this.loginCallbackWithAutoTokensRenewAsync.bind(this);
       this.initAsync.bind(this);
@@ -519,6 +526,7 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                     token_endpoint: authorityConfiguration.token_endpoint,
                     userinfo_endpoint: authorityConfiguration.userinfo_endpoint,
                     check_session_iframe: authorityConfiguration.check_session_iframe,
+                    issuer: authorityConfiguration.issuer,
                 });
             }
 
@@ -555,7 +563,7 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                         serviceWorker.startKeepAliveServiceWorker();
                         // @ts-ignore
                         this.tokens = tokens;
-                        this.serviceWorker = serviceWorker;
+                        //this.serviceWorker = serviceWorker;
                         // @ts-ignore
                         this.timeoutId = autoRenewTokens(this, this.tokens.refreshToken, this.tokens.expiresAt);
                         const sessionState = await serviceWorker.getSessionStateAsync();
@@ -583,7 +591,7 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                         // @ts-ignore
                         this.tokens = setTokens(tokens);
                         //session.setTokens(this.tokens);
-                        this.session = session;
+                        //this.session = session;
                         // @ts-ignore
                         this.timeoutId = autoRenewTokens(this, tokens.refreshToken, this.tokens.expiresAt);
                         const sessionState = session.getSessionState();
@@ -619,40 +627,76 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
     }
 
     loginPromise: Promise<any>=null;
-    async loginAsync(callbackPath:string=undefined, extras:StringMap=null, state:string=undefined, isSilentSignin:boolean=false, scope:string=undefined) {
+    async loginAsync(callbackPath:string=undefined, extras:StringMap=null, state:string=undefined, isSilentSignin:boolean=false, scope:string=undefined, silentLoginOnly = false) {
         if(this.loginPromise !== null){
             return this.loginPromise;
         }
         
         const loginLocalAsync=async () => {
-            try {
+            
                 const location = window.location;
                 const url = callbackPath || location.pathname + (location.search || '') + (location.hash || '');
-                this.publishEvent(eventNames.loginAsync_begin, {});
+               
                 const configuration = this.configuration;
 
+                if(silentLoginOnly){
+                    try {
+                        const extraFinal = extras ?? configuration.extras ?? {};
+                        const silentResult = await this.silentLoginAsync({
+                            ...extraFinal,
+                            prompt: "none"
+                        }, state, scope);
+
+                        if (silentResult) {
+                            this.tokens = silentResult.tokens;
+                            this.publishEvent(eventNames.token_aquired, {});
+                            // @ts-ignore
+                            this.timeoutId = autoRenewTokens(this, this.tokens.refreshToken, this.tokens.expiresAt);
+                            return {};
+                        }
+                    }catch (e) {
+                        return e;
+                    }
+                }
+            this.publishEvent(eventNames.loginAsync_begin, {});
+            try {
                 const redirectUri = isSilentSignin ? configuration.silent_redirect_uri : configuration.redirect_uri;
                 if (!scope) {
                     scope = configuration.scope;
                 }
 
+                const randomString = function(length) {
+                    let text = "";
+                    const possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+                    for(let i = 0; i < length; i++) {
+                        text += possible.charAt(Math.floor(Math.random() * possible.length));
+                    }
+                    return text;
+                }
+
                 setLoginParams(this.configurationName, redirectUri, {callbackPath: url, extras, state});
-                
+                const extraFinal = extras ?? configuration.extras ?? {};
+                if(!extraFinal.nonce) {
+                    extraFinal["nonce"] = randomString(12);
+                }
+                const nonce = {"nonce":extraFinal.nonce};
                 let serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
                 const oidcServerConfiguration = await this.initAsync(configuration.authority, configuration.authority_configuration);
                 let storage;
                 if (serviceWorker) {
                     serviceWorker.startKeepAliveServiceWorker();
                     await serviceWorker.initAsync(oidcServerConfiguration, "loginAsync");
+                    await serviceWorker.setNonceAsync(nonce);
                     storage = new MemoryStorageBackend(serviceWorker.saveItemsAsync, {});
                     await storage.setItem("dummy", {});
+                    
                 } else {
                     const session = initSession(this.configurationName, redirectUri);
+                    await session.setNonceAsync(nonce);
                     storage = new MemoryStorageBackend(session.saveItemsAsync, {});
                 }
-
-                const extraFinal = extras ?? configuration.extras ?? {};
-
+                
+                
                 // @ts-ignore
                 const queryStringUtil = redirectUri.includes("#") ? new HashQueryStringUtils() : new NoHashQueryStringUtils();
                 const authorizationHandler = new RedirectRequestHandler(storage, queryStringUtil, window.location, new DefaultCrypto());
@@ -746,9 +790,13 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
             const tokens = response.tokens;
             const parsedTokens = setTokens(tokens);
             this.tokens = parsedTokens;
-            if(!this.serviceWorker){
-                await this.session.setTokens(parsedTokens);
+            const oidc = this;
+            const serviceWorker = await initWorkerAsync(oidc.configuration.service_worker_relative_url, oidc.configurationName);
+            if (!serviceWorker) {
+                const session = initSession(this.configurationName, oidc.configuration.redirect_uri, oidc.configuration.storage);
+                await session.setTokens(parsedTokens);
             }
+            
             this.publishEvent(Oidc.eventNames.token_aquired, parsedTokens);
             // @ts-ignore
             return  { parsedTokens, state:response.state, callbackPath : response.callbackPath};
@@ -774,9 +822,10 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
             const sessionState =  queryParams.session_state;
             const serviceWorker = await initWorkerAsync(configuration.service_worker_relative_url, this.configurationName);
             let storage = null;
+            let nonceData = null;
             if(serviceWorker){
                 serviceWorker.startKeepAliveServiceWorker();
-                this.serviceWorker = serviceWorker;
+                //const serviceWorker = serviceWorker;
                 await serviceWorker.initAsync(oidcServerConfiguration, "loginCallbackAsync");
                 const items = await serviceWorker.loadItemsAsync();
                 storage = new MemoryStorageBackend(serviceWorker.saveItemsAsync, items);
@@ -786,14 +835,16 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                 }
                 await storage.removeItem("dummy");
                 await serviceWorker.setSessionStateAsync(sessionState);
+                nonceData = await serviceWorker.getNonceAsync();
             }else{
-                
-                this.session = initSession(this.configurationName, redirectUri, configuration.storage ?? sessionStorage);
+                //this.session = initSession(this.configurationName, redirectUri, configuration.storage ?? sessionStorage);
                 const session = initSession(this.configurationName, redirectUri);
                 session.setSessionState(sessionState);
                 const items = await session.loadItemsAsync();
                 storage = new MemoryStorageBackend(session.saveItemsAsync, items);
+                nonceData = await session.getNonceAsync();
             }
+
             return new Promise((resolve, reject) => {
                 // @ts-ignore
                 let queryStringUtil = new NoHashQueryStringUtils();
@@ -853,6 +904,16 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                                 if (serviceWorker) {
                                     const {tokens} = await serviceWorker.initAsync(oidcServerConfiguration, "syncTokensAsync");
                                     tokenResponse = tokens;
+                                };
+                                if(!isTokensOidcValid(tokenResponse, nonceData.nonce, oidcServerConfiguration)){
+                                    const exception = new Error("Tokens are not OpenID valid");
+                                    if(timeoutId) {
+                                        clearTimeout(timeoutId);
+                                        this.timeoutId=null;
+                                        this.publishEvent(eventNames.loginCallbackAsync_error, exception);
+                                        console.error(exception);
+                                        reject(exception);
+                                    }
                                 }
 
                                 // @ts-ignore
@@ -971,6 +1032,10 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
                             const oidcServerConfiguration = await this.initAsync(authority, configuration.authority_configuration);
                             const tokenResponse = await performTokenRequestAsync(oidcServerConfiguration.tokenEndpoint, details, extras)
                             if (tokenResponse.success) {
+                                if(!isTokensOidcValid(tokenResponse.data, null, oidcServerConfiguration)){
+                                    this.publishEvent(eventNames.refreshTokensAsync_error, {message: `refresh token return not valid tokens` });
+                                    return {tokens:null, status:"SESSION_LOST"};
+                                }
                                 this.publishEvent(eventNames.refreshTokensAsync_end, {success: tokenResponse.success});
                                 this.publishEvent(Oidc.eventNames.token_renewed, {});
                                 return {tokens: tokenResponse.data, status:"LOGGED_IN"};
@@ -1077,11 +1142,13 @@ Please checkout that you are using OIDC hook inside a <OidcProvider configuratio
          if(this.checkSessionIFrame){
              this.checkSessionIFrame.stop();
          }
-        if(this.serviceWorker){
-            await this.serviceWorker.clearAsync(status);
-        }
-         if(this.session){
-             await this.session.clearAsync(status);
+         const oidc = this;
+         const serviceWorker = await initWorkerAsync(oidc.configuration.service_worker_relative_url, oidc.configurationName);
+         if (!serviceWorker) {
+             const session = initSession(this.configurationName, oidc.configuration.redirect_uri, oidc.configuration.storage);
+             await session.clearAsync(status);
+         } else{
+             await serviceWorker.clearAsync(status);
          }
          this.tokens = null;
          this.userInfo = null;

package/src/oidc/vanilla/parseTokens.ts

@@ -51,7 +51,7 @@ export const setTokens = (tokens) =>{
     else {
         accessTokenPayload = extractAccessTokenPayload(tokens);
     }
-    const _idTokenPayload = idTokenPayload(tokens.idToken);
+    const _idTokenPayload = tokens.idTokenPayload ? tokens.idTokenPayload : idTokenPayload(tokens.idToken);
 
     const idTokenExipreAt =(_idTokenPayload && _idTokenPayload.exp) ? _idTokenPayload.exp: Number.MAX_VALUE;
     const accessTokenExpiresAt =  (accessTokenPayload && accessTokenPayload.exp)? accessTokenPayload.exp : tokens.issuedAt + tokens.expiresIn;
@@ -61,6 +61,7 @@ export const setTokens = (tokens) =>{
 }
 
 
+
 export const parseOriginalTokens= (tokens) =>{
     if(!tokens){
         return null;
@@ -104,4 +105,35 @@ export const isTokensValid= (tokens) =>{
         return false;
     }
     return computeTimeLeft(0, tokens.expiresAt) > 0;
+}
+
+// https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation (excluding rules #1, #4, #5, #7, #8, #12, and #13 which did not apply).
+// https://github.com/openid/AppAuth-JS/issues/65
+export const isTokensOidcValid =(tokens, nonce, oidcServerConfiguration) =>{
+    if(tokens.idTokenPayload) {
+        const idTokenPayload = tokens.idTokenPayload;
+        // 2: The Issuer Identifier for the OpenID Provider (which is typically obtained during Discovery) MUST exactly match the value of the iss (issuer) Claim.
+        if(oidcServerConfiguration.issuer !==  idTokenPayload.iss){
+            return false;
+        }
+        // 3: The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience. The aud (audience) Claim MAY contain an array with more than one element. The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+        
+        // 6: If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.
+        
+        // 9: The current time MUST be before the time represented by the exp Claim.
+        const currentTimeUnixSecond = new Date().getTime() /1000;
+        if(idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {
+            return false;
+        }
+        // 10: The iat Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that nonces need to be stored to prevent attacks. The acceptable range is Client specific.
+        const timeInSevenDays = 60 * 60 * 24 * 7;
+        if(idTokenPayload.iat && (idTokenPayload.iat + timeInSevenDays) < currentTimeUnixSecond) {
+            return false;
+        }
+        // 11: If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked to verify that it is the same value as the one that was sent in the Authentication Request. The Client SHOULD check the nonce value for replay attacks. The precise method for detecting replay attacks is Client specific.
+        if (idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {
+            return false;
+        }
+    }
+    return true;
 }