Let's say I am developing an client-based application for android/ios or a javascript application for any browser.

To identify a user, I'll use OpenIdConnect with the implicit flow. The IDP will provide id_token and access_token as requested. Calls to the used API will be secured via JWTBearer-Tokens by sending the access_token to the API.

The frontend will do some security-trimming via the id_token, but nothing fancy.

Now I am wondering..
Why should I care to load the key material from the IDP and check if the id_token is valid?
What are use-cases for native (and js) applications, which make it neccessary or useful to check the validity of the id_token?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.