Nonce validation fails in parse method for hybrid flow auth requests

In the parse method of AuthenticationRequest the 'nonce' parameter is validated like this

// Nonce required in implicit flow
        if (rt.impliesImplicitFlow() && nonce == null) {
            String msg = "Missing \"nonce\" parameter: Required in implicit flow";
            throw new ParseException(msg, OAuth2Error.INVALID_REQUEST.appendDescription(": " + msg),
                                 clientID, redirectURI, ar.impliedResponseMode(), state);
        }

However in the constructor the nonce param is validate with the following bit of code

// Nonce required for implicit protocol flow
if (nonce == null && (rt.impliesImplicitFlow() || rt.impliesHybridFlow()))
   throw new IllegalArgumentException("Nonce is required in implicit / hybrid protocol flow");

So if I parse the following request (A hybrid flow request, missing the nonce param) I end up getting an IllegalArgumentException instead of a ParseException.

GET /authorize?
    response_type=code%20id_token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &scope=openid%20profile
    &state=af0ifjsldkj  HTTP/1.1
  Host: server.example.com

Comments (8)