Add World ID to the list of supported providers

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Exchange.cs

@@ -66,13 +66,15 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 // Some providers implement old drafts of the OAuth 2.0 specification that
                 // didn't support the "response_type" parameter but relied on a "type"
                 // parameter to determine the type of request (web server or refresh).
-
+                //
+                // To support these providers, the "grant_type" parameter must be manually mapped
+                // to its equivalent "type" (e.g "web_server") before sending the token request.
                 if (context.Registration.ProviderType is ProviderTypes.Basecamp)
                 {
                     context.Request["type"] = context.Request.GrantType switch
                     {
                         GrantTypes.AuthorizationCode => "web_server",
-                        GrantTypes.RefreshToken => "refresh",
+                        GrantTypes.RefreshToken      => "refresh",
 
                         _ => null
                     };
@@ -80,6 +82,16 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                     context.Request.GrantType = null;
                 }
 
+                // World ID doesn't support the standard and mandatory redirect_uri parameter and returns
+                // a HTTP 500 response when specifying it in a grant_type=authorization_code token request.
+                //
+                // To prevent that, the redirect_uri parameter must be removed from the token request.
+                else if (context.GrantType is GrantTypes.AuthorizationCode &&
+                         context.Registration.ProviderType is ProviderTypes.WorldId)
+                {
+                    context.Request.RedirectUri = null;
+                }
+
                 return default;
             }
         }

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs

@@ -597,8 +597,9 @@ public static partial class OpenIddictClientWebIntegrationHandlers
             context.DisableBackchannelIdentityTokenNonceValidation = context.Registration.ProviderType switch
             {
                 // These providers don't include the nonce in their identity tokens:
-                ProviderTypes.Asana    or ProviderTypes.Dropbox or
-                ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline => true,
+                ProviderTypes.Asana    or ProviderTypes.Dropbox          or
+                ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline or
+                ProviderTypes.WorldId => true,
 
                 _ => context.DisableBackchannelIdentityTokenNonceValidation
             };

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -1395,6 +1395,19 @@
     </Environment>
   </Provider>
 
+  <!--
+                                        ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+                                        ██ ███ ██ ▄▄▄ ██ ▄▄▀██ █████ ▄▄▀███▄ ▄██ ▄▄▀██
+                                        ██ █ █ ██ ███ ██ ▀▀▄██ █████ ██ ████ ███ ██ ██
+                                        ██▄▀▄▀▄██ ▀▀▀ ██ ██ ██ ▀▀ ██ ▀▀ ███▀ ▀██ ▀▀ ██
+                                        ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+  -->
+
+  <Provider Name="WorldId" Id="cd8724ff-2413-4dd5-a18d-5979c9ddaa14"
+            DisplayName="World ID" Documentation="https://docs.worldcoin.org/reference/sign-in">
+    <Environment Issuer="https://id.worldcoin.org/" />
+  </Provider>
+
   <!--
                                                 ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                                                 █▄▀█▀▄██ ▄▄▄██ ▄▄▀██ ▄▄▄ ██

src/OpenIddict.Validation/OpenIddictValidationConfiguration.cs

@@ -92,7 +92,7 @@ public sealed class OpenIddictValidationConfiguration : IPostConfigureOptions<Op
 
         // If all the registered encryption credentials are backed by a X.509 certificate, at least one of them must be valid.
         if (options.EncryptionCredentials.Count is not 0 &&
-            options.EncryptionCredentials.TrueForAll(credentials => credentials.Key is X509SecurityKey x509SecurityKey &&
+            options.EncryptionCredentials.TrueForAll(static credentials => credentials.Key is X509SecurityKey x509SecurityKey &&
                 (x509SecurityKey.Certificate.NotBefore > DateTime.Now || x509SecurityKey.Certificate.NotAfter < DateTime.Now)))
         {
             throw new InvalidOperationException(SR.GetResourceString(SR.ID0087));