Allowing HTTP and/or localhost for implicit response types

[panva]

Note

Author: @panva
Target version: ^9.0.0

Warning

No guarantees this is bug-free, if you find a bug please comment on the discussion

Caution

This violates the OIDC Core 1.0 specification. Its only practical use-case is for development purposes and as such is not recommended for any production deployment.

import { Provider } from 'oidc-provider';

const provider = new Provider('/* your issuer identifier */', {
  clients: [
    {
      client_id: 'development-implicit',
      application_type: 'web',
      token_endpoint_auth_method: 'none',
      response_types: ['id_token'],
      grant_types: ['implicit'],
      redirect_uris: ['http://localhost:3001'], // this fails two regular validations http: and localhost
    },
  ],
});

const { invalidate: orig } = provider.Client.Schema.prototype;

provider.Client.Schema.prototype.invalidate = function invalidate(message, code) {
  if (code === 'implicit-force-https' || code === 'implicit-forbid-localhost') {
    return;
  }

  orig.call(this, message);
};

In addition to this you may also utilize extra client metadata and only skip these checks for clients still in development mode or similar.

[amadsen]

If you are using Typescript you will likely get a type error indicating "Property 'Schema' does not exist on type 'typeof Client'." when trying to use this code as presented. This appears to only be a bug in the type definition.

You can work around it with something like this:

      const Client = provider.Client;
      if ('Schema' in Client && typeof Client.Schema == 'function' && typeof Client.Schema.prototype?.invalidate == 'function') {
        const Schema = Client.Schema;
        const { invalidate: orig } = Schema.prototype;
        Schema.prototype.invalidate = function invalidate(message: string, code: string) {
          if (code === 'implicit-force-https' || code === 'implicit-forbid-localhost') {
            return;
          }

          orig.call(this, message);
        };
      }