Python Social Auth: OpenID Connect Nonce Is Not Bound To The Browser Session, So A Stolen Authorization Code Logs The At

Summary The generic OpenID Connect backend "OpenIdConnectAuth" and every backend built on it stores the "nonce" in the shared Association table, not in the user's session. When the ID token comes back, "validateclaims" only checks that the nonce exists in that table and is not expired. It does no...