erlef / oidcc / 121

91%

push

github

fix: support unsigned ID tokens even when JOSE disables them (#295)

By default, JOSE disables verification of `none` alg JWTs,
for (reasonable) security preferences. However,
`oidcc-client-test-idtoken-sig-none` says this is an optionally
supported use case. This updates the implementation of
`verify_signature` to return an error with the JWT/JWS values even when
JOSE is configured not to allow `none` signatures.

5 of 5 new or added lines in 2 files covered. (100.0%)

710 of 768 relevant lines covered (92.45%)

172.0 hits per line