oauth2-server-php icon indicating copy to clipboard operation
oauth2-server-php copied to clipboard
verified publisher icon bshaffer

pick up nonce correctly in authorize endpoint since it could be a POST request as well

Open ashfame opened this issue 3 years ago • 0 comments

This PR fixes the issue of missing nonce in id_token when it's set by the oauth client while hitting the Authorize Endpoint when POST request is used, breaking OIDC compliance.

OIDC Spec specifies both GET and POST are supported for Authorize Endpoint.

Fixes #768 which highlights the same issue

ashfame avatar Sep 21 '22 07:09 ashfame