Method isValidIDTokenHint

internal/http_handlers/logout.go:183–197

isValidIDTokenHint verifies a logout id_token_hint by parsing the JWT against the server's own signing key. The token does not need to be unexpired (the OIDC spec explicitly allows expired ID tokens as logout hints) — only that the signature is valid and the token claims to have been issued by this

(idTokenHint string)

// <img src="/logout"> CSRF vector because an attacker on a third-party
// page cannot synthesise a valid signature.
func (h *httpProvider) isValidIDTokenHint(idTokenHint string) bool {
	if idTokenHint == "" {
		return false
	}
	claims, err := h.TokenProvider.ParseJWTToken(idTokenHint)
	if err != nil || claims == nil {
		return false
	}
	// Sanity-check that this looks like an ID token (not, say, a refresh
	// token someone tried to slip through).
	if tt, ok := claims["token_type"].(string); ok && tt != "" && tt != "id_token" {
		return false
	}
	return true
}