Verify ID token before using as logout hint

Add verifyIdToken() function to validate ID tokens with full OIDC-compliant
checks (signature, issuer, expiration, audience) before passing to IdP.

If verification fails during logout, proceed without the id_token_hint
parameter rather than sending an unverified token.

Author: jmorton

src/lib/server/oidc.ts

@@ -130,6 +130,17 @@ export async function verify(
   }
 }
 
+/**
+ * Verify an ID token with full OIDC-compliant validation (signature, issuer, expiration, audience).
+ *
+ * @param idToken - The raw ID token string to verify
+ * @returns The decoded JWT payload if verification is successful
+ * @throws {Error} If the token is invalid, expired, or fails audience validation
+ */
+export async function verifyIdToken(idToken: string): Promise<MaybeToken> {
+  return verify(idToken, DEFAULT_JWKS_CLIENT, ID_TOKEN_VERIFY_OPTS);
+}
+
 /**
  * Verify that the nonce in an ID token matches the expected nonce.
  * This prevents replay attacks where an attacker reuses a previously issued ID token.

src/routes/oidc/logout/+server.ts

@@ -13,7 +13,20 @@ export const GET = async ({ cookies }) => {
   console.debug('/oidc/logout (GET)');
 
   const client = await auth.Client.instance;
-  const idToken = cookies.get('idToken') ?? '';
+  const idToken = cookies.get('idToken');
+
+  // Verify the ID token before using it as a hint to the IdP.
+  // If verification fails, we still proceed with logout but without the hint.
+  let verifiedIdToken: string | undefined;
+  if (idToken) {
+    try {
+      await auth.verifyIdToken(idToken);
+      verifiedIdToken = idToken;
+    } catch {
+      // Token invalid or expired - proceed without hint
+      console.debug('ID token verification failed during logout, proceeding without id_token_hint');
+    }
+  }
 
   // delete cookies here
   cookies.delete('accessToken', { path: '/' });
@@ -26,7 +39,9 @@ export const GET = async ({ cookies }) => {
   const logoutUrl = new URL(client.getLogoutEndpoint());
 
   logoutUrl.searchParams.set('post_logout_redirect_uri', `${ORIGIN}`);
-  logoutUrl.searchParams.set('id_token_hint', idToken);
+  if (verifiedIdToken) {
+    logoutUrl.searchParams.set('id_token_hint', verifiedIdToken);
+  }
 
   // redirect to the logout endpoint
   redirect(302, logoutUrl.toString());