prevent hybrid flow

brockallen · brockallen · commit 10b58d7d7f21 · 2018-12-06T11:45:26.000-08:00
diff --git a/src/OidcClient.js b/src/OidcClient.js
@@ -65,6 +65,10 @@ export class OidcClient {
 
         let authority = this._settings.authority;
 
+        if (SigninRequest.isCode(response_type) && response_type !== "code") {
+            return Promise.reject(new Error("OpenID Connect hybrid flow is not supported"));
+        }
+
         return this._metadataService.getAuthorizationEndpoint().then(url => {
             Log.debug("OidcClient.createSigninRequest: Received authorization endpoint", url);
 
diff --git a/src/ResponseValidator.js b/src/ResponseValidator.js
@@ -215,6 +215,11 @@ export class ResponseValidator {
     }
 
     _validateTokens(state, response) {
+        if (response.code) {
+            Log.debug("ResponseValidator._validateTokens: Validating code");
+            return this._processCode(state, response);
+        }
+
         if (response.id_token) {
             if (response.access_token) {
                 Log.debug("ResponseValidator._validateTokens: Validating id_token and access_token");
@@ -225,16 +230,11 @@ export class ResponseValidator {
             return this._validateIdToken(state, response);
         }
 
-        if (response.code) {
-            Log.debug("ResponseValidator._validateTokens: Validating code");
-            return this._validateCode(state, response);
-        }
-
-        Log.debug("ResponseValidator._validateTokens: No id_token to validate");
+        Log.debug("ResponseValidator._validateTokens: No code to process or id_token to validate");
         return Promise.resolve(response);
     }
 
-    _validateCode(state, response) {
+    _processCode(state, response) {
         var request = {
             client_id: state.client_id,
             code : response.code,
@@ -249,12 +249,13 @@ export class ResponseValidator {
             }
 
             if (response.id_token) {
-                Log.debug("ResponseValidator._validateCode: token response successful, parsing id_token");
+                Log.debug("ResponseValidator._processCode: token response successful, parsing id_token");
                 var jwt = this._joseUtil.parseJwt(response.id_token);
                 response.profile = jwt.payload;
+                //return this._validateIdToken(state, response);
             }
             else {
-                Log.debug("ResponseValidator._validateCode: token response successful, returning response");
+                Log.debug("ResponseValidator._processCode: token response successful, returning response");
             }
             
             return response;
diff --git a/test/unit/OidcClient.spec.js b/test/unit/OidcClient.spec.js
@@ -20,7 +20,6 @@ import { StubStateStore } from './StubStateStore';
 import { StubResponseValidator } from './StubResponseValidator';
 
 import chai from 'chai';
-import { Z_NO_COMPRESSION } from 'zlib';
 chai.should();
 let assert = chai.assert;
 
@@ -197,6 +196,30 @@ describe("OidcClient", function () {
             });
         });
 
+        it("should fail if hybrid code id_token requested", function (done) {
+            var p = subject.createSigninRequest({response_type:"code id_token"});
+            p.then(null, err => {
+                err.message.should.contain("hybrid");
+                done();
+            });
+        });
+
+        it("should fail if hybrid code token requested", function (done) {
+            var p = subject.createSigninRequest({response_type:"code token"});
+            p.then(null, err => {
+                err.message.should.contain("hybrid");
+                done();
+            });
+        });
+
+        it("should fail if hybrid code id_token token requested", function (done) {
+            var p = subject.createSigninRequest({response_type:"code id_token token"});
+            p.then(null, err => {
+                err.message.should.contain("hybrid");
+                done();
+            });
+        });
+
         it("should fail if metadata fails", function (done) {
 
             stubMetadataService.getAuthorizationEndpointResult = Promise.reject(new Error("test"));
