line / line-sdk-unity

Provides a modern way of implementing LINE APIs in Unity games, for iOS and Android.
https://developers.line.biz/
Apache License 2.0
117 stars 24 forks source link

Send nil if the nonce setting is missing #63

Closed onevcat closed 10 months ago

onevcat commented 10 months ago

If not set, LineSDKMakeNSString still converts a null value to an empty string, that causes an empty ID token nonce to be set in the auth URL when performing the request. In this case, the result ID token is lack of a nonce field, which fails the verification.

This fixes #62 and also maybe #61

Before

The login will fail due to ID Token verification with this code (if requesting an ID token but not setting the nonce):

var scopes = new string[] {"profile openid"};
LineSDK.Instance.Login(scopes, result => {
     // handle the result
});

FYI

A workaround in the old version, is setting your own nonce:

var scopes = new string[] {"profile openid"};
var option = new LoginOption();
option.IDTokenNonce = "abc123";

LineSDK.Instance.Login(scopes, option, result => {
     // handle the result
});

Now with this PR

The same code can work and a random strong nonce will be set in the native part, if not in the Unity side.