nhosoya / omniauth-apple

OmniAuth strategy for Sign In with Apple
MIT License
264 stars 101 forks source link

fix nonce validation #37

Closed btalbot closed 4 years ago

btalbot commented 4 years ago

The payload argument passed to #verify_nonce! comes directly from JWT.decode which responds with a hash using string keys and not symbols. Other uses of id_info all correctly use string keys.

Without this change, the #verify_nonce! method always handles the payload as if 'nonce_supported' is falsy.