openid-client 5.1.1 → 5.1.4

package/lib/client.js

@@ -37,6 +37,8 @@ const [major, minor] = process.version
 
 const rsaPssParams = major >= 17 || (major === 16 && minor >= 9);
 const retryAttempt = Symbol();
+const skipNonceCheck = Symbol();
+const skipMaxAgeCheck = Symbol();
 
 function pickCb(input) {
   return pick(
@@ -762,7 +764,7 @@ class BaseClient {
     const timestamp = now();
     const { protected: header, payload, key } = await this.validateJWT(idToken, expectedAlg);
 
-    if (maxAge || (maxAge !== null && this.require_auth_time)) {
+    if (typeof maxAge === 'number' || (maxAge !== skipMaxAgeCheck && this.require_auth_time)) {
       if (!payload.auth_time) {
         throw new RPError({
           message: 'missing required JWT property auth_time',
@@ -777,7 +779,7 @@ class BaseClient {
       }
     }
 
-    if (maxAge && payload.auth_time + maxAge < timestamp - this[CLOCK_TOLERANCE]) {
+    if (typeof maxAge === 'number' && payload.auth_time + maxAge < timestamp - this[CLOCK_TOLERANCE]) {
       throw new RPError({
         printf: [
           'too much time has elapsed since the last End-User authentication, max_age %i, auth_time: %i, now %i',
@@ -792,7 +794,7 @@ class BaseClient {
       });
     }
 
-    if (nonce !== null && (payload.nonce || nonce !== undefined) && payload.nonce !== nonce) {
+    if (nonce !== skipNonceCheck && (payload.nonce || nonce !== undefined) && payload.nonce !== nonce) {
       throw new RPError({
         printf: ['nonce mismatch, expected %s, got: %s', nonce, payload.nonce],
         jwt: idToken,
@@ -1090,7 +1092,7 @@ class BaseClient {
 
     if (tokenset.id_token) {
       await this.decryptIdToken(tokenset);
-      await this.validateIdToken(tokenset, null, 'token', null);
+      await this.validateIdToken(tokenset, skipNonceCheck, 'token', skipMaxAgeCheck);
 
       if (refreshToken instanceof TokenSet && refreshToken.id_token) {
         const expectedSub = refreshToken.claims().sub;

package/lib/helpers/issuer.js

@@ -38,7 +38,7 @@ async function getKeyStore(reload = false) {
             responseType: 'json',
             url: this.jwks_uri,
             headers: {
-              Accept: 'application/json',
+              Accept: 'application/json, application/jwk-set+json',
             },
           })
           .finally(() => {

package/lib/helpers/request.js

@@ -74,7 +74,7 @@ module.exports = async function request(options, { accessToken, mTLS = false, DP
     opts.headers = opts.headers || {};
     opts.headers.DPoP = await this.dpopProof(
       {
-        htu: url.href,
+        htu: `${url.origin}${url.pathname}`,
         htm: options.method,
         nonce: nonces.get(nonceKey),
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "5.1.1",
+  "version": "5.1.4",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",