adds s_hash only for authorization endpoint issued ID Tokens

x1B · Sep 9, 2017 · 4592940 · 4592940
1 parent 56d880f
commit 4592940
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 2 deletions.
diff --git a/lib/actions/token/authorization_code.js b/lib/actions/token/authorization_code.js
@@ -117,7 +117,6 @@ module.exports.handler = function getAuthorizationCodeHandler(provider) {
     token.set('nonce', code.nonce);
     token.set('at_hash', accessToken);
     token.set('rt_hash', refreshToken);
-    token.set('s_hash', code.state);
     token.set('sid', code.sid);
 
     const idToken = await token.sign(ctx.oidc.client);

diff --git a/lib/actions/token/refresh_token.js b/lib/actions/token/refresh_token.js
@@ -96,7 +96,6 @@ module.exports.handler = function getRefreshTokenHandler(provider) {
     token.set('nonce', refreshToken.nonce);
     token.set('at_hash', accessToken);
     token.set('rt_hash', refreshTokenValue);
-    token.set('s_hash', refreshToken.state);
     token.set('sid', refreshToken.sid);
 
     const idToken = await token.sign(ctx.oidc.client);