[#1130] Verify client assertions by their own alg; default id_token_signed_response_alg - #1131

Merged

vharseko merged 4 commits into

OpenIdentityPlatform:masterfrom

vharseko:fix/1130-client-assertion-alg-dispatch

Sep 18, 2026

Commits on Sep 15, 2026

[#1130] Verify client assertions by their own alg; default id_token_signed_response_alg
vharseko
committed
2b4a189

Commits on Sep 17, 2026

[#1130] Reject unknown alg, missing secret and key location cleanly; verify ID tokens by their configured alg
vharseko
committed
3dd4b80
[#1130] Fail closed on missing key material and alg/key mismatch; tolerate free-text id_token alg
vharseko
committed
6d58828
[#1130] Treat any JwsException as invalid_client; normalise the configured alg in IdTokenInfo
vharseko
committed
cbe6fd9