fix: id_token at_hash matching issue OKTA-417486 #906
Conversation
|
Codecov ReportAttention: Patch coverage is
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## master #906 +/- ##
==========================================
+ Coverage 91.95% 91.98% +0.03%
==========================================
Files 120 120
Lines 3392 3407 +15
Branches 701 700 -1
==========================================
+ Hits 3119 3134 +15
Misses 273 273 ☔ View full report in Codecov by Sentry. |
| @@ -229,107 +230,6 @@ describe('TokenManager (browser)', function() { | |||
| setupSync({}, true); | |||
| }); | |||
|
|
|||
| it('allows renewing an idToken, without renewing accessToken', function() { | |||
| }); | ||
| }); | ||
|
|
||
| it('allows renewing an accessToken, without renewing idToken', function() { |
| @@ -547,85 +448,6 @@ describe('TokenManager (browser)', function() { | |||
| }); | |||
| }); | |||
| }); | |||
|
|
|||
| it('automatically renews a token early when local clock offset is considered', function() { | |||
There was a problem hiding this comment.
covered in specs/tokenManager/core.ts
| }); | ||
| }); | ||
|
|
||
| it('renews a token early when "expireEarlySeconds" option is considered', function() { |
There was a problem hiding this comment.
covered in specs/tokenManager/core.ts
| }); | ||
| }); | ||
|
|
||
| it('does not return the token after tokens were cleared before renew promise was resolved', function() { |
There was a problem hiding this comment.
Removed due to this test does not make sense. As long as the renew process starts, renewed tokens should be added to storage, original storage should not matter.
| @@ -54,12 +54,12 @@ export const EVENT_ERROR = 'error'; | |||
|
|
|||
| interface TokenManagerState { | |||
| expireTimeouts: Record<string, unknown>; | |||
| renewPromise: Record<string, Promise<Token>>; | |||
| renewPromise: Promise<Token>; | |||
There was a problem hiding this comment.
This type is not exposed, should be ok to change.
also exposes crypto module from main lib
also removes authClient env vars
shuowu-okta
force-pushed
the
sw-fix-idToken-at_hash-matching-issue-OKTA-417486
branch
from
b52375b to
18044cf
Compare
- Checks idToken integrity during token auto renew process - Enables emitting `renewed` event for `TokenManager.setTokens` method - Exposes `crypto` util module OKTA-417486 <<<Jenkins Check-In of Tested SHA: 18044cf for eng_productivity_ci_bot_okta@okta.com>>> Artifact: okta-auth-js Files changed count: 15 PR Link: "#906"
This PR guarantees idToken (at_hash) can match with accessToken after token auto renew.