The OpenID Connect directory accepted any JWT the provider signed. An
ID token is minted for whichever client the user signed in to, so
anyone who signed in to another application at the same provider could
present that application's ID token here and be signed in as the user
it names. A refresh token presented as a bearer token was likewise not
told apart.
A JWT the provider marks as an ID, refresh, offline or logout token
(Keycloak's typ claim, Amazon Cognito's token_use) is now refused.
Unmarked tokens are still accepted; requiring an audience is what stops
an unmarked ID token, and stays the administrator's setting.
Test: a signed JWT with typ "ID" (or "Refresh", "Offline", or
token_use "id" or "refresh") signed in on main; it is now refused, and
access tokens still sign in.
jcoffey-dev
a4807d0d64