With OpenID Connect it's required to validate the ID Token audience claim to make sure the access token was issued for this specific client in order to prevent the Confused Deputy Problem. Now, in a web environment, this verification seems to be required both on the client side (in JavaScript) and the server side. I can see the kind of attacks prevented by the latter check, but not really with the former. Can someone explain what kind of attacks this prevents?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.