Fix: Missing events claim check on backchannel logout

CHANGELOG.md

@@ -14,6 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Check existence of subject when verifying JWT #474
+- Check existence of events claim when verifying Logout Token claims #480
 - exp verification when verifying Logout Token claims #482
 
 ## [1.0.1] - 2024-09-13

src/OpenIDConnectClient.php

@@ -525,6 +525,9 @@ public function verifyLogoutTokenClaims($claims): bool
                 return false;
             }
         }
+        else{
+            return false;
+        }
 
         // Validate the iss
         if (!$this->validateIssuer($claims->iss)) {

tests/OpenIDConnectClientTest.php

@@ -305,7 +305,6 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
                     'sid' => 'fake-client-sid',
                     'iat' => time(),
                     'exp' => time() + 300,
-                    'nonce' => 'must-not-be-set'
                 ],
                 false
             ],
@@ -317,7 +316,6 @@ public function provideTestVerifyLogoutTokenClaimsData(): array
                     'iat' => time(),
                     'exp' => time() + 300,
                     'events' => (object) [],
-                    'nonce' => 'must-not-be-set'
                 ],
                 false
             ],