do not require token signature by default

Author: leastprivilege

global.json

@@ -1,6 +1,7 @@
 {
   "sdk": {
     "version": "5.0.100",
-    "rollForward": "latestMajor"
+    "rollForward": "latestMajor",
+    "allowPrerelease": false
   }
 }

src/OidcClient/Policy.cs

@@ -42,7 +42,7 @@ public class Policy
         /// <value>
         /// <c>true</c> if identity token must be signed; otherwise, <c>false</c>.
         /// </value>
-        public bool RequireIdentityTokenSignature { get; set; } = true;
+        public bool RequireIdentityTokenSignature { get; set; } = false;
 
         /// <summary>
         /// Gets or sets a value indicating whether the identity token issuer name should match.

test/JwtValidationTests/CodeFlowResponseTestsWithJwtValidation.cs

@@ -183,6 +183,7 @@ public async Task Valid_response_with_missing_signature_should_succeed()
         [Fact]
         public async Task Valid_response_with_missing_signature_should_fail()
         {
+            _options.Policy.RequireIdentityTokenSignature = true;
             var client = new OidcClient(_options);
             var state = await client.PrepareLoginAsync();