Support nonce for Authorization Code and Implicit Grant

[m0ark]

Currently I have to integrate full OpenId Connect Core spec, so I came across https://github.com/steverhoades/oauth2-openid-connect-server to this library.

OIDC Implicit Flow requires a nonce to be included in the id_token issued. (see 3.2.2.1.)

In OIDC Authorization Code Grant the request can contain a nonce and in this case it has to be included in the id_token aswell (see 3.1.2.1.).

For OAuth2 handling nonces is only ever mentioned in a security advisory (mentioned in #634), but for OpenId Connect handling is mandatory. Since OpenId Connect is just an extension of OAuth2 i think nonces should be handled by the latter.

[Sephster]

We aren't supporting OpenId Connect at present but do plan to do so in the future. I don't believe including a nonce is required in any of the RFC's we currently support so don't think this will be added in until full support for OpenId Connect is.

[MichaelKubovic]

Hi @m0ark, how did you deal with the missing nonce?

[lordrhodos]

@m0ark I am interested in this as well. Hit the same issue.

[ThaDaVos]

Any ETA when the official OpenID connect is coming? I am running into the same issue that the nonce is missing - figured out one can easily add it inside https://github.com/steverhoades/oauth2-openid-connect-server IdTokenResponse using a ->withClaim('nonce', '<VALUE>') inside the overriden getBuilder method - but struggling to get the nonce all the way through so it's accessible there

[Sephster]

No plans to add into the next major so likely after that. Steve's repo is the best option for now 👍

[ThaDaVos]

Sadly it doesn't handle the nonce part (I am already using it) - but trying to make it spec compliant - any hint on how one uses the new AuthorizationRequestInterface introduced with #1110 ?

I can't find any docs of it but seems to be able to solve the issue

[ThaDaVos]

Nvm... V9 isn't even out yet....

[ThaDaVos]

I added a comment in steverhoades/oauth2-openid-connect-server#47 - how I did it today succesfully