erlef / oidcc / 123

92%

push

github

fix: don't crash if `none` is a supported request signing alg (#297)

* fix: don't crash if `none` is a supported request signing alg

Instead, catch the error and allow the upstream to fall back to a
different approach. For the `oidcc_authorization` module, that means
normal query parameters rather than a signed request object.

In particular, I ran into this when calling `create_redirect_url` with a
client ID and client secret (not `:unauthenticated`) when `none` is a
supported request signing alg.

This might be eliminating support for `none` signed request JWTs
entirely, but it wasn't clear whether that's required for clients.

* fix: support `none` signing if `unsecured_signing` is true

4 of 5 new or added lines in 1 file covered. (80.0%)

714 of 771 relevant lines covered (92.61%)

172.5 hits per line