According to the documentation setNonce
I expect the nonce will be included as a claim from the IDToken, however, after setting the nonce with the following code:
oneTapClient = Identity.getSignInClient(getContext());
BeginSignInRequest signInRequest = BeginSignInRequest.builder()
.setGoogleIdTokenRequestOptions(BeginSignInRequest.GoogleIdTokenRequestOptions.builder()
.setSupported(true)
.setServerClientId(clientId)
.setNonce("5qb6kvo0q8drrzs50dkv5uzci1ft7p1")
.setFilterByAuthorizedAccounts(false)
.build())
.build();
and get the id token from:
SignInCredential credential = null;
try {
credential = oneTapClient.getSignInCredentialFromIntent(data);
String idToken = credential.getGoogleIdToken();
} catch (ApiException e) {
...
}
Decode the returned idToken, the nonce is missing.
Is it a defect? or did I miss something?
Also, in the documentation Verify the integrity of the ID token, it does not mention the nonce validation defined under ID Token Validation