-
Notifications
You must be signed in to change notification settings - Fork 278
Description
If the authorization server does not support nonce, the authorization fails with the following error:
{"type":0,"code":9,"errorDescription":"Invalid ID Token"}
The issue is pretty straightforward — after the token exchange, the native library performs token validation. Since the authorization request automatically sets its own nonce by default (and we don’t override it), but the token response lacks a nonce, the library throws an exception.
The native appAuth library says the for servers that does not support nonce we need to set nonce as null (https://github.com/openid/AppAuth-Android) but Flutter plugin ignore this functionality:
` FlutterAppauthPlugin.java
if (nonce != null) {
authRequestBuilder.setNonce(nonce);
}
`
Please add the ability to set nonce as null for such cases