Check `ClientMetadataValidator`
Closed this issue · 4 comments
babisRoutis commented
Please check ClientMetadataValidator
Possible problems
- Usage of unsafe methods
JWEAlgorithm.parse
,JWSAlgorithm.parse
andEncryptionMethod.parse
. - Validator raises various exceptions
UnsupportedOpertation
,RuntimeException
,IllegalArgumentException
etc. Perhaps we can introduce a genericInvalidClientMetadata
carrying a optional cause (String)
babisRoutis commented
Instead of JWSAlgorithm.parse()
we can use something like
fun parseSignAlg(s: String) : JWSAlgorithm? =
JWSAlgorithm.parse(s).takeIf { JWAlgorithm.Family.SIGNING.contains(it)}
babisRoutis commented
For the ugly part that check if an encryption algorithm and an encoding method are both either empty or non empty
We can use a helper function
fun <T> bothOrNone(left: T, right: T): ((T) -> Boolean) -> Boolean = { test ->
when (test(left) to test(right)) {
true to true -> true
false to false -> true
else -> false
}
With this we can add the requirement
require ( bothOrNone(alg,ec){it.isNullOrEmpty} )
babisRoutis commented
babisRoutis commented
Created #134 to track id token requirements