Oidc-client-js: Question about nonce behavior

[arnaldo-infinite]

I did not find any explanation for which i am looking for in the docs or previous issues, hence I would like to ask from here. The nonce value is supposed to be sent during the authentication request and obtain it via the identity token to ensure and prevent replay attacks. Where before implementing a nonce value, by default I could see a nonce being generated and passed in the identity token obtained via the authentication response. Is this a natural behavior and can i used it for replay verification ?

[brockallen]

As of now the nonce is all handled internally

[arnaldo-infinite]

Hey Brock, thank you so much for the quick response. I would like to confirm if the same applies to the behavior of the "state" parameter which is used to maintain state between the request and the callback?

[brockallen]

state is for you to use anyway you want

[arnaldo-infinite]

Cool, I've got all my answers. Great work on this library mate. Thank you so much for your efforts. 🥇