Non-Compliance with the OpenID Connect Standard

[kmzs]

The library is not fully compliant to the OpenID Connect standard.
The following aspects differ from the standard:

1. The ID Token must contain the two timestamps iat and exp (see here). The library does not strictly enforce the presence of the exp claim and does not consider the iat at all. Instead the nbf claim used (L932 + L933). This claim is described in the JWT standard (RFC 7519) but not explicitly part of an ID Token according to the OpenID Connect standard.
2. The library does not take into account that the Authorization Code Flow and Implicit Flow require different parameters to be present. When using the Implicit Flow both nonce and at_hash are mandatory claims (see here) while they are optional when the Authorization Code Flow is used (see here and here).