Android One Tap SignIn, nonce is missing from the generated ID Token

Viewed 782

According to the documentation setNonce

I expect the nonce will be included as a claim from the IDToken, however, after setting the nonce with the following code:

      oneTapClient = Identity.getSignInClient(getContext());
        BeginSignInRequest signInRequest = BeginSignInRequest.builder()
                .setGoogleIdTokenRequestOptions(BeginSignInRequest.GoogleIdTokenRequestOptions.builder()
                        .setSupported(true)
                        .setServerClientId(clientId)
                        .setNonce("5qb6kvo0q8drrzs50dkv5uzci1ft7p1")
                        .setFilterByAuthorizedAccounts(false)
                        .build())
                .build();

and get the id token from:

SignInCredential credential = null;
            try {
                credential = oneTapClient.getSignInCredentialFromIntent(data);
                String idToken = credential.getGoogleIdToken();
               
            } catch (ApiException e) {
               ...
            }

Decode the returned idToken, the nonce is missing.

Is it a defect? or did I miss something?

Also, in the documentation Verify the integrity of the ID token, it does not mention the nonce validation defined under ID Token Validation

0 Answers
Related