Fix/check nonce state hs256 tokens

.babelrc

@@ -1,8 +1,8 @@
 {
   "env": {
     "test": {
-      "plugins": ["istanbul"],
-      "presets": ["env"]
+      "plugins": ["babel-plugin-istanbul"],
+      "presets": ["@babel/preset-env"]
     }
   }
-}
+}

.nycrc

@@ -1,7 +1,7 @@
 {
   "reporter"   : ["text-summary", "lcov"],
   "include"    : ["src/**/*.js", "plugins/**/*.js"],
-  "require"    : ["babel-register"],
+  "require"    : ["@babel/register"],
   "sourceMap"  : false,
   "instrument" : false,
   "all"        : true

package.json

@@ -26,9 +26,9 @@
   "scripts": {
     "start": "rollup -c --watch",
     "build": "rm -rf dist && rm -rf build && rollup -c --prod && cp -rf dist build",
-    "test": "cross-env BABEL_ENV=test mocha --require babel-register --require jsdom-global/register test/**/*.test.js --exit",
+    "test": "cross-env BABEL_ENV=test mocha --require @babel/register --require jsdom-global/register test/**/*.test.js --exit",
     "test:coverage": "nyc --check-coverage -- npm test",
-    "test:integration": "cross-env BABEL_ENV=test mocha-parallel-tests --compilers babel-register --compilers jsdom-global/register --max-parallel 2 integration/**/*.test.js",
+    "test:integration": "cross-env BABEL_ENV=test mocha-parallel-tests --compilers @babel/register --compilers jsdom-global/register --max-parallel 2 integration/**/*.test.js",
     "test:watch": "npm run test -- --watch -R min",
     "test:es-check:es5": "es-check es5 'dist/!(*.esm)*.js'",
     "test:es-check:es2015:module": "es-check es2015 --module 'dist/auth0.min.esm.js'",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "base64-js": "^1.2.0",
-    "idtoken-verifier": "^1.3.1",
+    "idtoken-verifier": "^1.4.0",
     "js-cookie": "^2.2.0",
     "qs": "^6.4.0",
     "superagent": "^3.8.3",
@@ -56,9 +56,10 @@
   },
   "devDependencies": {
     "@auth0/component-cdn-uploader": "auth0/component-cdn-uploader#v2.2.1",
-    "babel-plugin-istanbul": "^4.1.6",
-    "babel-preset-env": "^1.7.0",
-    "babel-register": "^6.26.0",
+    "@babel/core": "^7.4.5",
+    "@babel/preset-env": "^7.4.5",
+    "@babel/register": "^7.4.4",
+    "babel-plugin-istanbul": "^5.1.4",
     "codecov": "^3.0.2",
     "cross-env": "^5.1.6",
     "es-check": "^5.0.0",

rollup.config.js

@@ -14,33 +14,31 @@ const isProduction = argv.prod === true;
 
 const OUTPUT_PATH = 'dist';
 
-const getPlugins = isProduction => {
-  return [
-    resolve({
-      browser: true
+const getPlugins = prod => [
+  resolve({
+    browser: true
+  }),
+  commonjs(),
+  json(),
+  replace({
+    __DEV__: prod ? 'false' : 'true',
+    'process.env.NODE_ENV': prod ? "'production'" : "'development'"
+  }),
+  prod &&
+    terser({
+      compress: { warnings: false },
+      output: { comments: false },
+      mangle: false
     }),
-    commonjs(),
-    json(),
-    replace({
-      __DEV__: isProduction ? 'false' : 'true',
-      'process.env.NODE_ENV': isProduction ? "'production'" : "'development'"
-    }),
-    isProduction &&
-      terser({
-        compress: { warnings: false },
-        output: { comments: false },
-        mangle: false
-      }),
-    license({
-      banner: `
+  license({
+    banner: `
     <%= pkg.name %> v<%= pkg.version %>
     Author: Auth0
     Date: <%= moment().format('YYYY-MM-DD') %>
     License: MIT
     `
-    })
-  ];
-};
+  })
+];
 
 const prodFiles = [
   {

src/web-auth/index.js

@@ -294,6 +294,12 @@ WebAuth.prototype.validateAuthenticationResponse = function(options, parsedHash,
     if (decodedToken.header.alg !== 'HS256') {
       return callback(validationError);
     }
+    if (decodedToken.payload.nonce !== transactionNonce) {
+      return callback({
+        error: 'invalid_token',
+        errorDescription: 'Nonce does not match.'
+      });
+    }
     if (!parsedHash.access_token) {
       var noAccessTokenError = {
         error: 'invalid_token',

test/web-auth/web-auth.test.js

@@ -22,7 +22,9 @@ import WebAuth from '../../src/web-auth';
 function restoreAndStubStoredTransaction(expectedState, expectedTransaction) {
   TransactionManager.prototype.getStoredTransaction.restore();
   stub(TransactionManager.prototype, 'getStoredTransaction', function(state) {
-    expect(state).to.be(expectedState);
+    if (state !== 'ignore-test-state-check') {
+      expect(state).to.be(expectedState);
+    }
     return expectedTransaction;
   });
 }
@@ -1221,17 +1223,18 @@ describe('auth0.WebAuth', function() {
           cb(null, { from: 'userinfo' });
         });
 
-        var data = this.webAuth.parseHash(
+        this.webAuth.parseHash(
           {
+            nonce: 'the-nonce',
             hash:
-              '#state=foo&access_token=VjubIMBmpgQ2W2&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+              '#state=foo&access_token=VjubIMBmpgQ2W2&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
           },
           function(err, data) {
             expect(err).to.be(null);
             expect(data).to.be.eql({
               accessToken: 'VjubIMBmpgQ2W2',
               idToken:
-                'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg',
+                'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk',
               idTokenPayload: { from: 'userinfo' },
               appState: null,
               refreshToken: 'kajshdgfkasdjhgfas',
@@ -1253,13 +1256,14 @@ describe('auth0.WebAuth', function() {
           __disableExpirationCheck: true
         });
         stub(IdTokenVerifier.prototype, 'verify', function(_, __, cb) {
-          cb({ message: 'Nonce does not match.' });
+          cb({ error: true });
         });
 
+        //nonce: the-nonce
         webAuth.parseHash(
           {
             hash:
-              '#state=foo&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+              '#state=foo&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
           },
           function(err, data) {
             expect(err).to.be.eql({
@@ -1270,6 +1274,33 @@ describe('auth0.WebAuth', function() {
           }
         );
       });
+      it('should still throw an error with an invalid state', function(done) {
+        var webAuth = new WebAuth({
+          domain: 'auth0-tests-lock.auth0.com',
+          redirectUri: 'http://example.com/callback',
+          clientID: 'ixeOHFhD7NSPxEQK6CFcswjUsa5YkcXS',
+          responseType: 'id_token',
+          __disableExpirationCheck: true
+        });
+        stub(IdTokenVerifier.prototype, 'verify', function(_, __, cb) {
+          cb({ error: true });
+        });
+
+        //nonce: the-nonce
+        webAuth.parseHash(
+          {
+            hash:
+              '#state=ignore-test-state-check&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+          },
+          function(err, data) {
+            expect(err).to.be.eql({
+              error: 'invalid_token',
+              errorDescription: '`state` does not match.'
+            });
+            done();
+          }
+        );
+      });
       it('should throw an error when there is no access_token to call /userinfo', function(done) {
         var webAuth = new WebAuth({
           domain: 'auth0-tests-lock.auth0.com',
@@ -1282,10 +1313,11 @@ describe('auth0.WebAuth', function() {
           cb({ any: 'error' });
         });
 
-        var data = webAuth.parseHash(
+        webAuth.parseHash(
           {
+            nonce: 'the-nonce',
             hash:
-              '#state=foo&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+              '#state=foo&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
           },
           function(err, data) {
             expect(err).to.be.eql({
@@ -1302,10 +1334,11 @@ describe('auth0.WebAuth', function() {
           cb({ any: 'error' });
         });
 
-        var data = this.webAuth.parseHash(
+        this.webAuth.parseHash(
           {
+            nonce: 'the-nonce',
             hash:
-              '#state=foo&access_token=VjubIMBmpgQ2W2&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJodHRwczovL2F1dGgwLXRlc3RzLWxvY2suYXV0aDAuY29tLyIsImlhdCI6MTUwOTA0MDk4MiwiZXhwIjoxNTQwNTc2OTgyLCJhdWQiOiJpeGVPSEZoRDdOU1B4RVFLNkNGY3N3alVzYTVZa2NYUyIsInN1YiI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJHaXZlbk5hbWUiOiJKb2hubnkiLCJTdXJuYW1lIjoiUm9ja2V0IiwiRW1haWwiOiJqcm9ja2V0QGV4YW1wbGUuY29tIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19._JvcLjX308NtT16oegF2wFeOcdEYKM3DqX-V4POwIeg&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+              '#state=foo&access_token=VjubIMBmpgQ2W2&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE1NjA4ODU1NzgsImV4cCI6MTU5MjQyMTU3OCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIm5vbmNlIjoidGhlLW5vbmNlIn0.jb9aG21kGibxKPIyfn8FfvjQ3ykJGiBGcep2hDHHfqk&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
           },
           function(err, data) {
             expect(err).to.be.eql({ any: 'error' });