nginx-openid-connect icon indicating copy to clipboard operation
nginx-openid-connect copied to clipboard

Optional ID token is required upon token refresh

Open anderius opened this issue 1 year ago • 1 comments

Our setup fails to refresh tokens, simply because our IdP does not return id_token in the refresh token response.

As can be seen here, that is optional: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse

Upon successful validation of the Refresh Token, the response body is the Token Response of Section 3.1.3.3 except that it might not contain an id_token.

The code here, however, requires id_token:

https://github.com/nginxinc/nginx-openid-connect/blob/afa8f4c01cee5da509e74cdfcf837df088a70b13/openid_connect.js#L85-L92

It would be nice if id_token was not required.

anderius avatar Sep 23 '24 07:09 anderius