Hello everyone.
I am using `apple-sign-in` and on their docs, it mentions that you should verify the identity token.
To verify the identity token, your app server must:
- Verify the JWS E256 signature using the server’s public key
- Verify the
for the authentication <-- issuenonce
How Do I verify the `nonce`? on the decoded identity token I am not getting the `nonce` field as per docs:
The identity token is a JSON Web Token (JWT) and contains the following claims:
iss
The issuer-registered claim key, which has the value
https://appleid.apple.com
.sub
The unique identifier for the user.
aud
Your
client_id
in your Apple Developer account.exp
The expiry time for the token. This value is typically set to 5 minutes.
iat
The time the token was issued.
nonce
A String value used to associate a client session and an ID token. This value is used to mitigate replay attacks and is present only if passed during the authorization request.
email
The user's email address.
email_verified
A Boolean value that indicates whether the service has verified the email. The value of this claim is always true because the servers only return verified email addresses.
These are the fields that I get:
{
"iss": "",
"aud": "",
"exp": ,
"iat":,
"sub": "",
"c_hash": "",
"email": "",
"email_verified": "true",
"auth_time": ""
}
Please help!