refactor: move assertJwtClaimsAndHeader after regular JWT claims set …

…validation
panva · Nov 20, 2024 · 05f6bf4 · 05f6bf4
1 parent 3768192
commit 05f6bf4
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/lib/actions/authorization/process_request_object.js b/lib/actions/authorization/process_request_object.js
@@ -157,19 +157,19 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
     ignoreAzp: true,
   };
 
+  try {
+    JWT.assertPayload(payload, opts);
+  } catch (err) {
+    throw new InvalidRequestObject('Request Object claims are invalid', err.message);
+  }
+
   await conf.features.requestObjects.assertJwtClaimsAndHeader(
     ctx,
     structuredClone(decoded.payload),
     structuredClone(decoded.header),
     client,
   );
 
-  try {
-    JWT.assertPayload(payload, opts);
-  } catch (err) {
-    throw new InvalidRequestObject('Request Object claims are invalid', err.message);
-  }
-
   if (pushedRequestObject) {
     ({ trusted } = pushedRequestObject);
   } else {

diff --git a/test/fapi/fapi-id2.test.js b/test/fapi/fapi-id2.test.js
@@ -129,6 +129,7 @@ describe('Financial-grade API - Part 2: Read and Write API Security Profile (ID2
 
     it('requires exp to be provided in the Request Object', async function () {
       const request = await new SignJWT({
+        aud: this.provider.issuer,
         client_id: 'client',
         scope: 'openid',
         iss: 'client',