litejs / server / 36137321094

100%

push

github

auth: Check id_token aud, iss and exp claims

OIDC Core 3.1.3.7 lets a client skip the id_token signature when the
token comes straight from the token endpoint over TLS, but the claims
must still be checked. Without the aud check a token issued to another
client was accepted as a login.

iss is optional per provider, as multi-tenant issuers like Microsoft's
embed the tenant id.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

1106 of 1106 branches covered (100.0%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

1817 of 1817 relevant lines covered (100.0%)

1914.43 hits per line