@pi0 & @JoaoPedroAS51 Please review this.

You can enforce a nonce being sent by setting the response_type to id_token.

See:
https://github.com/nuxt-community/auth-module/blob/v4.9.1/lib/schemes/oauth2.js#L106

@jkupcho I agree with you. But, If I need to set nonce without id_token like in my case. It was not possible since it is a programmatic flaw.

we are extracting nonce from params in https://github.com/nuxt-community/auth-module/blob/v4.9.1/lib/schemes/oauth2.js#L82

However, we are setting nonce only if response_type is id_token as you pointed out.

My expectation was setting nonce through params however because of above-explained logic nonce cannot be set through params unless response_type is id_token.

Let me know, if you agree with me or not.

Yeah I think that makes sense. Are you seeing flows where the nonce is necessary outside of id_token?

Keycloak has nonce enabled for token also. Default value of nonce usage in Keycloak is true.

useNonce - Adds a cryptographic nonce to verify that the authentication response matches the request (default is true).
https://www.keycloak.org/docs/latest/securing_apps/#methods