Update all the token type validation delegates to assume that tokens that don't have a "typ" header are generic JSON Web Tokens

Author: kevinchalet

src/OpenIddict.Client/OpenIddictClientOptions.cs

@@ -113,9 +113,15 @@ public sealed class OpenIddictClientOptions
         ClockSkew = TimeSpan.Zero,
         NameClaimType = Claims.Name,
         RoleClaimType = Claims.Role,
-        // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.
         TypeValidator = static (type, token, parameters) =>
         {
+            // Assume that tokens that don't have an explicit "typ" header attached are generic JSON Web Tokens.
+            if (string.IsNullOrEmpty(type))
+            {
+                type = JsonWebTokenTypes.GenericJsonWebToken;
+            }
+
+            // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.
             if (parameters.ValidTypes is not null && parameters.ValidTypes.Any() &&
                !parameters.ValidTypes.Contains(type, StringComparer.OrdinalIgnoreCase))
             {

src/OpenIddict.Client/OpenIddictClientRegistration.cs

@@ -190,9 +190,15 @@ public sealed class OpenIddictClientRegistration
         ClockSkew = TimeSpan.Zero,
         NameClaimType = Claims.Name,
         RoleClaimType = Claims.Role,
-        // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.
         TypeValidator = static (type, token, parameters) =>
         {
+            // Assume that tokens that don't have an explicit "typ" header attached are generic JSON Web Tokens.
+            if (string.IsNullOrEmpty(type))
+            {
+                type = JsonWebTokenTypes.GenericJsonWebToken;
+            }
+
+            // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.
             if (parameters.ValidTypes is not null && parameters.ValidTypes.Any() &&
                !parameters.ValidTypes.Contains(type, StringComparer.OrdinalIgnoreCase))
             {

src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs

@@ -119,6 +119,12 @@ TokenValidationParameters GetClientTokenValidationParameters()
                     {
                         TypeValidator = static (type, token, parameters) =>
                         {
+                            // Assume that tokens that don't have an explicit "typ" header attached are generic JSON Web Tokens.
+                            if (string.IsNullOrEmpty(type))
+                            {
+                                type = JsonWebTokenTypes.GenericJsonWebToken;
+                            }
+
                             // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.
                             if (parameters.ValidTypes is not null && parameters.ValidTypes.Any() &&
                                !parameters.ValidTypes.Contains(type, StringComparer.OrdinalIgnoreCase))

src/OpenIddict.Server/OpenIddictServerOptions.cs

@@ -154,11 +154,10 @@ public sealed class OpenIddictServerOptions
                 };
             }
 
-            // At this point, throw an exception if the type cannot be resolved from the "typ" header
-            // (provided via the type delegate parameter) or inferred from the token_usage claim.
+            // Assume that tokens that don't have an explicit "typ" header attached are generic JSON Web Tokens.
             if (string.IsNullOrEmpty(type))
             {
-                throw new SecurityTokenInvalidTypeException(SR.GetResourceString(SR.ID0270));
+                type = JsonWebTokenTypes.GenericJsonWebToken;
             }
 
             // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.

src/OpenIddict.Validation/OpenIddictValidationOptions.cs

@@ -185,11 +185,10 @@ public sealed class OpenIddictValidationOptions
                 };
             }
 
-            // At this point, throw an exception if the type cannot be resolved from the "typ" header
-            // (provided via the type delegate parameter) or inferred from the token_usage claim.
+            // Assume that tokens that don't have an explicit "typ" header attached are generic JSON Web Tokens.
             if (string.IsNullOrEmpty(type))
             {
-                throw new SecurityTokenInvalidTypeException(SR.GetResourceString(SR.ID0270));
+                type = JsonWebTokenTypes.GenericJsonWebToken;
             }
 
             // Note: unlike IdentityModel, this custom validator deliberately uses case-insensitive comparisons.