You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description:
Currently there is no support for ID token encryption with the java-oidc-sdk. As per the OIDC spec [1], it is optional to encrypt the ID token. But, encrypting the ID token using JWS[2] would provide "confidentiality".
Once implemented, it should adhere to the ID Token validation rules on the encrypted ID Tokens.
If the ID Token is encrypted, decrypt it using the keys and algorithms that the Client specified during Registration that the OP was to use to encrypt the ID Token. If encryption was negotiated with the OP at Registration time and the ID Token is not encrypted, the RP SHOULD reject it.
Description:
Currently there is no support for ID token encryption with the java-oidc-sdk. As per the OIDC spec [1], it is optional to encrypt the ID token. But, encrypting the ID token using JWS[2] would provide "confidentiality".
[1] - https://openid.net/specs/openid-connect-messages-1_0-10.html#id_token
[2] - https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41
The text was updated successfully, but these errors were encountered: