I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.

I do understand that during the code exchange for an access token the user receives an access_token and on top of that also an id_token. The ID token has personal information like email and username amongst other things.

My main questions

  1. How will the browser be able to verify the ID token? Will the frontend need to be shared the signature key ahead of time?
  2. Does having the id_token mean that session cookies become obsolete in the application? Is it safe to treat them as the same?
  • Why does the browser need to verify anything? Commented Nov 20, 2019 at 22:31
  • @multithr3at3d well say there is an email in the id_token. I guess it makes sense to ensure that the email has not been tampered by a 3rd party since it might be shown in the frontend. Commented Nov 21, 2019 at 0:16
  • Who would be able to tamper with it? If a malicious party can edit your token, they could probably just steal it altogether Commented Nov 21, 2019 at 0:24
  • @multithr3at3d well the whole point of JWT from my understanding is to prove the authenticity of the data. And since JWT is a requirement for OpenID Connect, I assume there is a reason. Else I think it would be mentioned that simple JSON can be used. Commented Nov 21, 2019 at 0:31

1 Answer 1


To answer your questions:

  1. When it comes to id_token validation, the client needs to verify the integrity and authenticity of the token header and payload by checking the token signature. Yes, the frontend needs to have either client_secret, or public_key of the identity provider. Where it gets it from is implementation-specific, but it can be either embedded inside the client, or the client should download it from the trusted source. The full step-by-step guide of token validation using OpenID Connect is described here: https://connect2id.com/blog/how-to-validate-an-openid-connect-id-token

  2. You still need the session cookie/token. id_token and session_token serve different purposes and have a different life span. Session token has a shorter life span and had to be refreshed regularly (unless the auth timeout is disabled, which is a questionable choice from a security point of view). While identity token usually only gets renewed with the new login.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .