to calculate at_hash and c_hash always using signing alg value

jalauros · jalauros · commit 0afe6ef3cee4 · 2018-12-09T09:54:46.000+02:00
diff --git a/src/main/java/org/oidc/msg/AbstractMessage.java b/src/main/java/org/oidc/msg/AbstractMessage.java
@@ -621,6 +621,17 @@ protected boolean isValidStructure() {
     }
     return true;
   }
+  
+  /**
+   * Get the jwe/jwt header of the message. Header exists only if the message is deserialized from
+   * or serialized to jwe/jwt. If the message is serialized to, the header is the outermost header.
+   * If message is deserialized from, then header is the innermost header.
+   * 
+   * @return header.
+   */
+  public Map<String, Object> getHeader() {
+    return header;
+  }
 
   /**
    * Get error description of message parameter verification.
diff --git a/src/main/java/org/oidc/msg/oidc/AuthenticationResponse.java b/src/main/java/org/oidc/msg/oidc/AuthenticationResponse.java
@@ -22,8 +22,6 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-
-import org.oidc.msg.DeserializationException;
 import org.oidc.msg.ErrorDetails;
 import org.oidc.msg.ErrorType;
 import org.oidc.msg.ParameterVerification;
@@ -235,7 +233,7 @@ protected void doVerify() {
               "at_hash must be in id token if returned with access token"));
         } else {
           String atHash = TokenHash.compute((String) getClaims().get("access_token"),
-              JWT.decode((String) getClaims().get("id_token")).getAlgorithm());
+              (String) idToken.getHeader().get("alg"));
           if (!((String) idToken.getClaims().get("at_hash")).equals(atHash)) {
             getError().getDetails().add(new ErrorDetails("at_hash", ErrorType.VALUE_NOT_ALLOWED,
                 String.format("at_hash in id token not same as expected value '%s'", atHash)));
@@ -251,7 +249,7 @@ protected void doVerify() {
               idTokenErrorDetails.toString()));
         } else {
           String codeHash = TokenHash.compute((String) getClaims().get("code"),
-              JWT.decode((String) getClaims().get("id_token")).getAlgorithm());
+              (String) idToken.getHeader().get("alg"));
           if (!((String) idToken.getClaims().get("c_hash")).equals(codeHash)) {
             ErrorDetails idTokenErrorDetails = new ErrorDetails("c_hash", 
                 ErrorType.VALUE_NOT_ALLOWED,
