Works with jwk thumbprint and updated tests

Author: jaxoncreed

package-lock.json

@@ -48,6 +48,7 @@
     "base64url": "^3.0.1",
     "isomorphic-webcrypto": "^2.3.2",
     "jsonwebtoken": "^8.5.1",
+    "jwk-thumbprint": "^0.1.3",
     "jwk-to-pem": "^2.0.3",
     "qs": "^6.9.0",
     "whatwg-url": "^7.1.0"

package.json

@@ -3,6 +3,7 @@
  */
 const { JWT } = require('@solid/jose')
 const { random } = require('./crypto')
+const { jwkThumbprintByEncoding } = require('jwk-thumbprint')
 
 const DEFAULT_MAX_AGE = 1209600  // Default Access token expiration, in seconds
 const DEFAULT_SIG_ALGORITHM = 'RS256'
@@ -109,7 +110,9 @@ class DpopAccessToken extends JWT {
       scope = code.scope
     }
 
-    const cnf = request.dpopJwk;
+    const cnf = {
+      jkt: jwkThumbprintByEncoding(request.dpopJwk, "SHA-256", 'base64url')
+    }
 
     const options = { aud, sub, scope, alg, jti, iat, max, cnf }
 

src/DpopAccessToken.js

@@ -194,7 +194,7 @@ class TokenRequest extends BaseRequest {
       method = 'clientSecretJWT'
     }
 
-    if (req.body && req.body.client_id) {
+    if (req.body && req.body.client_id && !req.body.client_secret) {
       method = 'clientId'
     }
 

src/handlers/TokenRequest.js

@@ -94,7 +94,7 @@ describe('AuthenticationRequest', () => {
       return AuthenticationRequest.handle(req, res, provider)
         .then(() => {
           let redirectUrl = res._getRedirectUrl()
-          expect(redirectUrl.startsWith('https://example.com/callback#access_token'))
+          expect(redirectUrl.startsWith('https://example.com/callback?access_token'))
             .to.be.true()
 
           expect(res._getStatusCode()).to.equal(302)
@@ -540,7 +540,7 @@ describe('AuthenticationRequest', () => {
         params = { 'redirect_uri': 'https://app.com/callback' }
         req = HttpMocks.createRequest({ method: 'GET', query: params })
         request = new AuthenticationRequest(req, res, provider)
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -561,7 +561,7 @@ describe('AuthenticationRequest', () => {
         params = { client_id: 'uuid' }
         req = HttpMocks.createRequest({ method: 'GET', query: params })
         request = new AuthenticationRequest(req, res, provider)
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -584,7 +584,7 @@ describe('AuthenticationRequest', () => {
         provider = { host }
         request = new AuthenticationRequest(req, res, provider)
         request.client = null
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -608,7 +608,7 @@ describe('AuthenticationRequest', () => {
         provider = { host }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -636,7 +636,7 @@ describe('AuthenticationRequest', () => {
         provider = { host }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -668,7 +668,7 @@ describe('AuthenticationRequest', () => {
         provider = { host }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -701,7 +701,7 @@ describe('AuthenticationRequest', () => {
         provider = { host }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -731,10 +731,11 @@ describe('AuthenticationRequest', () => {
             'https://example.com/callback'
           ]
         }
-        provider = { host }
+        provider = { host, response_types_supported: ['id_token token'] }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
+        request.validateLegacyPop(request)
       })
 
       after(() => {
@@ -771,7 +772,7 @@ describe('AuthenticationRequest', () => {
         }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -810,7 +811,7 @@ describe('AuthenticationRequest', () => {
         }
         request = new AuthenticationRequest(req, res, provider)
         request.client = client
-        request.validate(request)
+        request.validateCommon(request)
       })
 
       after(() => {
@@ -848,7 +849,7 @@ describe('AuthenticationRequest', () => {
       })
 
       it('should return the request', () => {
-        let result = request.validate(request)
+        let result = request.validateCommon(request)
         expect(result).to.equal(request)
       })
     })

test/handlers/AuthenticationRequestSpec.js

@@ -531,7 +531,13 @@ describe('TokenRequest', () => {
 
         let res = {}
         let host = {}
-        let provider = { host, grant_types_supported: ['client_credentials'] }
+        let provider = {
+          host,
+          grant_types_supported: ['client_credentials'],
+          backend: {
+            get: async () => {}
+          }
+        }
 
         request = new TokenRequest(req, res, provider)
         request.authenticateClient(request)