nonce parameter is not accessible

[nicokaiser]

// 'id_token' grant type (Implicit Flow)
server.grant(oauth2orizeOpenid.grant.idToken(issueIDToken));

...

function issueIDToken(client, user, done) {
    debug('Issuing ID Token');
    done(null, jwt.encode({
        'iss': config.baseUrl,
        'sub': user.id,
        'aud': client.clientId,
        'exp': now() + config.idTokenTTL,
        'iat': now(),
        'nonce': ...
        'auth_time': now()
    }, config.key, config.idTokenAlg));
}

http://openid.net/specs/openid-connect-core-1_0-17.html

In issueIDToken I have to include the nonce value from the request parameter, but I have no chance to access the request. Even with server.grant(oauth2orizeOpenid.extensions()); there seems to be no interface to get the nonce value (despite the extensions function extracting it from the request somehow).

What's the prefered way to solve this? OpenID consumers seem to rely on the nonce being correctly returned.

[bzuillsmith]

You need to extend the code grant like

server.grant({
    name: 'code',
    request: (req) => {
        let ext = {},
            q = req.query;
    
        if(q.nonce) ext.nonce = q.nonce;
    
        return ext;
    }
});

I basically modified the PKCE extension which you can see here https://github.com/jaredhanson/oauth2orize-pkce/blob/master/lib/request/extensions.js

Now the nonce parameter will be parsed and put on areq in your IssueGrantCodeFunction

server.grant(oauth2orize.grant.code(async (client, redirectUri, user, ares, areq, done) => {
    // save the areq.nonce somewhere... probably with the authorization code you issue
}));