Update claims instead of overwrite from webhook response

[3schwartz]

According to the webhook documentation:

To accept the token exchange without modification, return a 204 or 200 HTTP status code without a response body.

However, this behavior is currently not functioning as expected. When an empty response is returned, it overwrites the additional claims sent to the webhook, effectively erasing them.

Related issue(s)

#3879

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

[CLAassistant]

All committers have signed the CLA.

[3schwartz]

Hi @aeneasr, @hperl, @alnr,

Would any of you have some time to take a look at this? I’d really appreciate your input.

[aeneasr]

Thank you for the PR and sorry for the slow response! I think the problem here really is with incorrect documentation. It should read:

To not make any changes to the token payload, mirror it in full:

requestBody := res.Body.Read()
// do nothing
send({
access_token_session: requestBody.session.ext
id_token_session: requestBody.session.id_token.ext
})

The issue with this PR is that it doesn't allow us to remove elements from the array and it's a breaking change in the behavior, hence I would prefer that we fix the incorrect documentation