UserInfo response subject must be verified

[hotgazpacho]

According to the OpenID Connect UserInfo Response spec:

NOTE: Due to the possibility of token substitution attacks (see Section 16.11), the UserInfo Response is not guaranteed to be about the End-User identified by the sub (subject) element of the ID Token. The sub Claim in the UserInfo Response MUST be verified to exactly match the sub Claim in the ID Token; if they do not match, the UserInfo Response values MUST NOT be used.

[hotgazpacho]

Right now, I'm monkey patching this in my Rails app like so:

def user_info
  @user_info ||= begin
    _user_info = access_token.userinfo!
    if id_token.sub.eql?(_user_info.sub)
      _user_info
    else
      Rails.logger.tagged("OpenID Connect") { Rails.logger.warn("UserInfo subject does not match ID Token subject. Discarding UserInfo response.") }
      ::OpenIDConnect::ResponseObject::UserInfo.new(sub: '😶')
    end
  end
end