{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/278","labels_url":"https://api.github.com/repos/aspnet/Security/issues/278/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/278/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/278/events","html_url":"https://github.com/aspnet/Security/issues/278","id":81616393,"number":278,"title":"OpenIdConnect needs additional validation of the response.","user":{"login":"brentschmaltz","id":3172421,"avatar_url":"https://avatars.githubusercontent.com/u/3172421?v=3","gravatar_id":"","url":"https://api.github.com/users/brentschmaltz","html_url":"https://github.com/brentschmaltz","followers_url":"https://api.github.com/users/brentschmaltz/followers","following_url":"https://api.github.com/users/brentschmaltz/following{/other_user}","gists_url":"https://api.github.com/users/brentschmaltz/gists{/gist_id}","starred_url":"https://api.github.com/users/brentschmaltz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brentschmaltz/subscriptions","organizations_url":"https://api.github.com/users/brentschmaltz/orgs","repos_url":"https://api.github.com/users/brentschmaltz/repos","events_url":"https://api.github.com/users/brentschmaltz/events{/privacy}","received_events_url":"https://api.github.com/users/brentschmaltz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-27T20:43:44Z","updated_at":"2015-05-27T20:43:44Z","closed_at":null,"body":"Currently OIDC handler needs to consider the entire message when validating if a message is protocol compliant. Several areas need addressing. \r\n\r\nSome are easy: id_token + access_token arrives, the at_hash needs to be evaluated, similar to c_hash. The nonce claim is required in the 'code' and 'token' hybrid flows.\r\n\r\nSome are more subtle (from spec): \r\nIf the auth_time Claim was requested, either through a specific request for this Claim or by using the max_age parameter, the Client SHOULD check the auth_time Claim value and request re-authentication if it determines too much time has elapsed since the last End-User authentication. \r\n\r\nIf the JWT alg Header Parameter uses a MAC based algorithm such as HS256, HS384, or HS512, the octets of the UTF-8 representation of the client_secret corresponding to the client_id contained in the aud (audience) Claim are used as the key to validate the signature. For MAC based algorithms, the behavior is unspecified if the aud is multi-valued or if an azp value is present that is different than the aud value. \r\n\r\netc. some we should support, others we may want to leave to validation of the RP since the spec calls out that the behavior is client specific.\r\n\r\nAt a minimum I suggest:\r\n1. change the API to OpenIdConnectProtocolValidator to take the OpenIdConnectMessage and other info.\r\n2. we introduce a delegate, possibly on OIDCPValidator, that can be called for additional validation so that users don't have to derive for custom processing.\r\n"}}