check for nonce when response type contains id token

jalauros · jalauros · commit 2549c2c1bf56 · 2018-07-17T14:39:33.000+03:00
diff --git a/src/main/java/org/oidc/msg/AuthenticationRequest.java b/src/main/java/org/oidc/msg/AuthenticationRequest.java
@@ -75,16 +75,20 @@ public boolean verify() throws InvalidClaimException {
     // TODO: what is the following ''Nonce in id_token not matching nonce in authz'
     
     String spaceSeparatedScopes = ((String) getClaims().get("scope"));
-    
     if (spaceSeparatedScopes == null
         || !Pattern.compile("\\bopenid\\b").matcher(spaceSeparatedScopes).find()) {
       getError().getMessages().add("Parameter scope must exist and contain value openid");
     }
     
-    List<String> prompt = ((List<String>) getClaims().get("prompt"));
+    String responseType = (String) getClaims().get("response_type");
+    if (Pattern.compile("\\bid_token\\b").matcher(responseType).find()
+        && (getClaims().get("nonce") == null || ((String) getClaims().get("nonce")).isEmpty())) {
+      getError().getMessages().add("Nonce is mandatory if response type contains id_token");
+    }
     
+    List<String> prompt = ((List<String>) getClaims().get("prompt"));
     if (prompt != null && prompt.contains("none") && prompt.size() > 1) {
-      getError().getMessages().add("prompt value none must not be used with other values");
+      getError().getMessages().add("Prompt value none must not be used with other values");
     }
     
     if (Pattern.compile("\\boffline_access\\b").matcher(spaceSeparatedScopes).find()) {
diff --git a/src/test/java/org/oidc/msg/AuthenticationRequestTest.java b/src/test/java/org/oidc/msg/AuthenticationRequestTest.java
@@ -51,6 +51,23 @@ public void testSuccessOfflineAccess() throws InvalidClaimException {
     Assert.assertEquals("consent", ((List<String>) req.getClaims().get("prompt")).get(0));
     Assert.assertEquals("openid offline_access", req.getClaims().get("scope"));
   }
+  
+  @Test
+  public void testSuccessResponseTypeIdToken() throws InvalidClaimException {
+    claims.put("response_type", "id_token token");
+    claims.put("nonce", "DFHGFG");
+    AuthenticationRequest req = new AuthenticationRequest(claims);
+    req.verify();
+    Assert.assertEquals("DFHGFG", (String) req.getClaims().get("nonce"));
+    Assert.assertEquals("id_token token", req.getClaims().get("response_type"));
+  }
+  
+  @Test(expected = InvalidClaimException.class)
+  public void testFailResponseTypeIdTokenMissingNonce() throws InvalidClaimException {
+    claims.put("response_type", "id_token token");
+    AuthenticationRequest req = new AuthenticationRequest(claims);
+    req.verify();
+  }
 
   @Test(expected = InvalidClaimException.class)
   public void testFailOfflineAccessNoConsent() throws InvalidClaimException {
