fix: Fix $jwt not defined and nonce validation in Implicit Flow

Author: maicol07

src/Traits/ImplictFlow.php

@@ -33,16 +33,17 @@ private function implictFlow(Request $request, string $id_token): bool
         }
         Session::remove('oidc_state');
 
-        $this->validateJWT($id_token);
+        $jwt = $this->jwt()->parser()->parse($id_token);
+        $this->validateJWT($jwt);
 
-        // Save the id token
-        $this->id_token = $id_token;
-
-        if ($this->enable_nonce && $request->get('nonce') === Session::get('oidc_nonce')) {
-            return true;
+        if ($this->enable_nonce && Session::get('oidc_nonce') !== $jwt->claims()->get('nonce')) {
+            throw new ClientException("Generated nonce is not equal to the one returned by the server.");
         }
         Session::remove('oidc_nonce');
 
-        throw new ClientException('Unable to verify JWT claims');
+        // Save the id token
+        $this->id_token = $id_token;
+
+        return true;
     }
 }

src/Traits/JWT.php

@@ -46,10 +46,12 @@ trait JWT
     private bool $jwt_plain_key;
     private int $leeway;
 
-    private function validateJWT(string $id_token): void
+    private function validateJWT(string|\Lcobucci\JWT\Token $jwt): void
     {
         try {
-            $jwt = $this->jwt()->parser()->parse($id_token);
+            if (is_string($jwt)) {
+                $jwt = $this->jwt()->parser()->parse($jwt);
+            }
             $claims = $jwt->claims();
             if (!(
                 $claims->has(RegisteredClaims::EXPIRATION_TIME)

src/Traits/Token.php

@@ -140,7 +140,8 @@ private function token(Request $request, string $code): bool
             throw new ClientException('User did not authorize openid scope.');
         }
 
-        $this->validateJWT($token_response->get('id_token'));
+        $jwt = $this->jwt()->parser()->parse($token_response->get('id_token'));
+        $this->validateJWT($jwt);
 
         if ($this->enable_nonce && Session::get('oidc_nonce') !== $jwt->claims()->get('nonce')) {
             throw new ClientException("Generated nonce is not equal to the one returned by the server.");