Hello everyone.
I am using `apple-sign-in` and on their docs, it mentions that you should verify the identity token.
To verify the identity token, your app server must:
- Verify the JWS E256 signature using the server’s public key
- Verify the
for the authentication <-- issuenonce
How Do I verify the `nonce`? on the decoded identity token I am not getting the `nonce` field as per docs:
The identity token is a JSON Web Token (JWT) and contains the following claims:
issThe issuer-registered claim key, which has the value
https://appleid.apple.com.subThe unique identifier for the user.
audYour
client_id in your Apple Developer account.expThe expiry time for the token. This value is typically set to 5 minutes.
iatThe time the token was issued.
nonceA String value used to associate a client session and an ID token. This value is used to mitigate replay attacks and is present only if passed during the authorization request.
emailThe user's email address.
email_verifiedA Boolean value that indicates whether the service has verified the email. The value of this claim is always true because the servers only return verified email addresses.
These are the fields that I get:
{
"iss": "",
"aud": "",
"exp": ,
"iat":,
"sub": "",
"c_hash": "",
"email": "",
"email_verified": "true",
"auth_time": ""
}
Please help!