interface

pkg/rp/default_verifier.go

@@ -3,12 +3,9 @@ package rp
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
-	"crypto/sha512"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"hash"
 	"strings"
 	"time"
 
@@ -446,29 +443,12 @@ func (v *DefaultVerifier) verifyAccessToken(accessToken, atHash string, sigAlgor
 		return nil //TODO: return error
 	}
 
-	tokenHash, err := getHashAlgorithm(sigAlgorithm)
+	actual, err := oidc.AccessTokenHash(accessToken, sigAlgorithm)
 	if err != nil {
 		return err
 	}
-
-	tokenHash.Write([]byte(accessToken)) // hash documents that Write will never return an error
-	sum := tokenHash.Sum(nil)[:tokenHash.Size()/2]
-	actual := base64.RawURLEncoding.EncodeToString(sum)
 	if actual != atHash {
 		return nil //TODO: error
 	}
 	return nil
 }
-
-func getHashAlgorithm(sigAlgorithm jose.SignatureAlgorithm) (hash.Hash, error) {
-	switch sigAlgorithm {
-	case jose.RS256, jose.ES256, jose.PS256:
-		return sha256.New(), nil
-	case jose.RS384, jose.ES384, jose.PS384:
-		return sha512.New384(), nil
-	case jose.RS512, jose.ES512, jose.PS512:
-		return sha512.New(), nil
-	default:
-		return nil, fmt.Errorf("oidc: unsupported signing algorithm %q", sigAlgorithm)
-	}
-}