Introducing a feature toggle for JTI in tokenAuth

[alvinangjh]

In oidc-provider/lib/shared/token_jwt_auth.js, the function getTokenJwtAuth checks for the presence of payload.jti, which is used for Replay Detection. However, RFC-7519 states that jti is optional. The same statement iss mentioned in several other auth documentation such as Okta.

Hence, I would like to know if there is any future plan for jti to be made optional?

[panva]

Client authentication methods client_secret_jwt and private_key_jwt are defined in OpenID Connect Core 1.0, the jti claim is REQUIRED in these assertions.

Hence, I would like to know if there is any future plan for jti to be made optional?

There is not. OAuth profiles such as FAPI use the OIDC definition, with jti REQUIRED.