fix nonce

database/migrations/structure/20250820_0113_oauth_nonce_null.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `oauth_sessions`
+MODIFY `nonce` varchar(255) CHARACTER SET ascii COLLATE ascii_bin DEFAULT NULL;

src/Controller/OAuthController.php

@@ -109,8 +109,10 @@ class OAuthController
             'nbf' => $session->getCreatedDate()->getTimestamp(),
             'exp' => $token->getExpiresDate()->getTimestamp(),
             'aud' => $session->getClientId(),
-            'nonce' => $session->getNonce()
         ];
+        if ($session->getNonce() !== null) {
+            $commonPayload['nonce'] = $session->getNonce();
+        }
         $idTokenPayload = array_merge($commonPayload, $this->getUserInfoInternal(
             $this->userRepository->getById($session->getUserId()),
             $session->getScopeArray())

src/Controller/OAuthSessionController.php

@@ -29,7 +29,7 @@ class OAuthSessionController implements IAuthenticationRequired
         $clientId = \Container::$request->query('client_id');
         $scope = \Container::$request->query('scope') ? \Container::$request->query('scope'): '';
         $state = \Container::$request->query('state');
-        $nonce = \Container::$request->query('nonce') ? \Container::$request->query('nonce'): '';
+        $nonce = \Container::$request->query('nonce') ? \Container::$request->query('nonce'): null;
         $codeChallenge = \Container::$request->query('code_challenge') ?: null;
         $codeChallengeMethod = \Container::$request->query('code_challenge_method') ?: null;
 

src/PersistentData/Model/OAuthSession.php

@@ -19,7 +19,7 @@ class OAuthSession extends Model
 
     private array $scope = [];
 
-    private string $nonce = '';
+    private ?string $nonce = '';
 
     private ?string $codeChallenge = null;
 
@@ -52,7 +52,7 @@ class OAuthSession extends Model
         $this->setScopeArray(explode(' ', $scope));
     }
 
-    public function setNonce(string $nonce): void
+    public function setNonce(?string $nonce): void
     {
         $this->nonce = $nonce;
     }
@@ -125,7 +125,7 @@ class OAuthSession extends Model
         return $this->scope;
     }
 
-    public function getNonce(): string
+    public function getNonce(): ?string
     {
         return $this->nonce;
     }