fix: reset jti and hash ID token claims on refresh (#523)

ory · Oct 28, 2020 · ce2de73 · ce2de73
1 parent 1fcb789
commit ce2de73
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/handler/openid/flow_refresh_token.go b/handler/openid/flow_refresh_token.go
@@ -62,6 +62,9 @@ func (c *OpenIDConnectRefreshHandler) HandleTokenEndpointRequest(ctx context.Con
 	// We need to reset the expires at value
 	sess.IDTokenClaims().ExpiresAt = time.Time{}
 	sess.IDTokenClaims().Nonce = ""
+	sess.IDTokenClaims().JTI = ""
+	sess.IDTokenClaims().AccessTokenHash = ""
+	sess.IDTokenClaims().CodeHash = ""
 	return nil
 }