auth0 / express-openid-connect

An Express.js middleware to protect OpenID Connect web applications.
MIT License
476 stars 141 forks source link

Use old `id_token` if new `id_token` not in refresh response #629

Open wryrye opened 4 months ago

wryrye commented 4 months ago

Description

In the case where a new id_token is not present in a refresh response, let's avoid setting id_token to undefined and instead use the old id_token!

References

Issue: #628

Testing

  1. Make a refresh request (req.oidc.accessToken.refresh()) where the response is missing an id_token
  2. Confirm subsequent accesses of req.oidc.idToken and req.oidc.user are NOT undefined

Checklist