DefaultAccessTokenValidator

Default AccessTokenValidator that validates the at_hash claim in an ID token against the SHA-256 left-half hash of the access token, per OpenID Connect Core 1.0.

Validation is skipped if the at_hash claim is absent from the ID token. Only the RS256 algorithm is supported.

Constructors

constructor()

open suspend override fun validate(accessToken: String, idToken: Jwt)

Validates the accessToken against the at_hash claim in the idToken.