@connectid-tools/rp-nodejs-sdk 5.1.0 → 5.2.0

package/README.md

@@ -468,6 +468,15 @@ The required function parameters are:
 
 # Release Notes
 
+### 5.2.0 (Mar 23, 2026)
+
+- **OpenID Connect Discovery Section 4.3 Compliance**: Implemented issuer validation to ensure the issuer value in the provider configuration matches the Issuer URL used to retrieve it
+  - Added validation that compares the issuer in `/.well-known/openid-configuration` response with the expected issuer URL
+  - Properly handles trailing slash normalisation per RFC 3986
+  - Throws descriptive exception when issuer mismatch is detected, stopping the flow as required by the specification
+  - Validates both fresh and cached issuer metadata
+
+
 ### 5.1.0 (Feb 12, 2026)
 
 **HTTP Response Cache Implementation**

package/model/discovery-service.d.ts

@@ -31,6 +31,15 @@ export declare class DiscoveryService {
      * @throws Error if the JWKS cannot be fetched or parsed
      */
     static fetchJwks(jwksUri: string, httpAgent?: Agent, cache?: HttpResponseCache): Promise<JWKSet>;
+    /**
+     * Validates that the issuer in the discovery document matches the expected issuer
+     * derived from the discovery URL, as required by OpenID Connect Discovery Section 4.3.
+     *
+     * @param discoveryUrl - The URL used to fetch the discovery document
+     * @param metadata - The fetched discovery document
+     * @throws Error if the issuer does not match
+     */
+    private static validateIssuerMatch;
     /**
      * Validates that required discovery document fields are present.
      *

package/model/discovery-service.js

@@ -38,6 +38,8 @@ export class DiscoveryService {
             const metadata = (await response.json());
             // Validate required fields
             this.validateDiscoveryDocument(metadata);
+            // Validate issuer matches the discovery URL (OpenID Connect Discovery Section 4.3)
+            this.validateIssuerMatch(discoveryUrl, metadata);
             // Apply mtls_endpoint_aliases if present
             const processedMetadata = this.applyMtlsAliases(metadata);
             // Cache successful response
@@ -95,6 +97,24 @@ export class DiscoveryService {
             throw new Error(`Failed to fetch JWKS from ${jwksUri}: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    /**
+     * Validates that the issuer in the discovery document matches the expected issuer
+     * derived from the discovery URL, as required by OpenID Connect Discovery Section 4.3.
+     *
+     * @param discoveryUrl - The URL used to fetch the discovery document
+     * @param metadata - The fetched discovery document
+     * @throws Error if the issuer does not match
+     */
+    static validateIssuerMatch(discoveryUrl, metadata) {
+        const wellKnownSuffix = '/.well-known/openid-configuration';
+        if (discoveryUrl.endsWith(wellKnownSuffix)) {
+            const expectedIssuer = discoveryUrl.slice(0, -wellKnownSuffix.length).replace(/\/+$/, '');
+            const actualIssuer = metadata.issuer.replace(/\/+$/, '');
+            if (actualIssuer !== expectedIssuer) {
+                throw new Error(`Issuer mismatch: discovery document issuer "${metadata.issuer}" does not match expected issuer "${expectedIssuer}" derived from discovery URL`);
+            }
+        }
+    }
     /**
      * Validates that required discovery document fields are present.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@connectid-tools/rp-nodejs-sdk",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "Digital Identity Relying Party Node SDK",
   "main": "relying-party-client-sdk.js",
   "types": "relying-party-client-sdk.d.ts",
@@ -32,7 +32,7 @@
   "dependencies": {
     "https": "^1.0.0",
     "jose": "^6.0.0",
-    "undici": "^7.16.0",
+    "undici": "^7.24.0",
     "winston": "^3.17.0"
   },
   "devDependencies": {

package/relying-party-client-sdk.js

@@ -28,7 +28,7 @@ export default class RelyingPartyClientSdk {
             throw new Error('Either ca_pem or ca_pem_content must be provided');
         }
         this.logger = getLogger(this.config.data.log_level);
-        this.logger.info(`Creating RelyingPartyClientSdk - version 5.1.0`);
+        this.logger.info(`Creating RelyingPartyClientSdk - version 5.2.0`);
         // Validate and set purpose
         if (this.config.data.purpose) {
             const purposeValidation = validatePurpose(this.config.data.purpose);

package/utils/user-agent.d.ts

@@ -1,2 +1,2 @@
-export declare const packageJsonVersion = "5.1.0";
+export declare const packageJsonVersion = "5.2.0";
 export declare const buildUserAgent: (clientId: string) => string;

package/utils/user-agent.js

@@ -1,4 +1,4 @@
 import { getSystemInformation } from './system-information.js';
 // important: Update this every time the package version changes
-export const packageJsonVersion = '5.1.0';
+export const packageJsonVersion = '5.2.0';
 export const buildUserAgent = (clientId) => `cid-rp-nodejs-sdk/${packageJsonVersion} ${getSystemInformation()} +${clientId}`;