I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint.

It starts with a frontend SPA initiating an OAuth2 Implicit grant with the openid scope. Important to note is that this is not an OIDC Implicit grant as only an access_token is returned. The token is then used in communications to the backend API, which uses the token to request attributes from the userinfo endpoint. The user is considered authenticated as the user returned from userinfo.

My first assessment is that this should be fine, as long as the TLS certificate on the userinfo endpoint is validated. However, I am not comfortable stating this to the customer since the flow seems to lack some of the key parts of OIDC, and I have never seen this flow promoted anywhere by anyone.


I can't see a vulnerability in the described flow. However, a lot of much smarter and competent people work on standards, such as OIDC. And there is probably a reason why they designed it the way they did. So I would argue using a non-standard flow is dangerous, even if the problem is not immediately obvious to us.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.