feat: add parameter in client registration request to include claims in id_token

[duttarnab]

closes #9357

[dryrunsecurity]

DryRun Security Summary

The code changes in the registerClient.tsx file are related to the implementation of an OIDC client registration process, including the addition of a new field, handling of client expiration and token lifetimes, making a POST request to the registration endpoint, and storing the registered OIDC client information in the browser's local storage.

Expand for full summary

Summary:

The code changes in the registerClient.tsx file appear to be related to the implementation of an OIDC (OpenID Connect) client registration process. The changes include the addition of a new field jansInclClaimsInIdTkn to the registerObj object, which is set to "true". This field is likely related to including claims in the ID token, and it's important to ensure that the claims included in the ID token do not contain sensitive information that could be used to compromise the application or user data.

The code also includes a check for the expireAt value and sets the lifetime property of the registerObj accordingly. Proper handling of client expiration and token lifetimes is crucial for maintaining the security of the application. Additionally, the registerOIDCClient function makes a POST request to the registration endpoint with the registerObj data, which should be properly validated and sanitized to prevent potential security issues like injection attacks. The code also stores the registered OIDC client information in the browser's local storage, which should be carefully managed and protected, as it may contain sensitive information like client IDs and secrets.

Files Changed:

• demos/jans-tarp/src/options/registerClient.tsx: This file appears to be related to the implementation of an OIDC client registration process. The changes include the addition of a new field jansInclClaimsInIdTkn to the registerObj object, a check for the expireAt value and setting the lifetime property, making a POST request to the registration endpoint with the registerObj data, storing the registered OIDC client information in the browser's local storage, and using the uuidv4 function to generate a unique client name. The code also includes error handling and displays error messages to the user.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.