I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.

I do understand that during the code exchange for an access token the user receives an access_token and on top of that also an id_token. The ID token has personal information like email and username amongst other things.

My main questions

  1. How will the browser be able to verify the ID token? Will the frontend need to be shared the signature key ahead of time?
  2. Does having the id_token mean that session cookies become obsolete in the application? Is it safe to treat them as the same?
  • Why does the browser need to verify anything? Nov 20 '19 at 22:31
  • @multithr3at3d well say there is an email in the id_token. I guess it makes sense to ensure that the email has not been tampered by a 3rd party since it might be shown in the frontend. Nov 21 '19 at 0:16
  • Who would be able to tamper with it? If a malicious party can edit your token, they could probably just steal it altogether Nov 21 '19 at 0:24
  • @multithr3at3d well the whole point of JWT from my understanding is to prove the authenticity of the data. And since JWT is a requirement for OpenID Connect, I assume there is a reason. Else I think it would be mentioned that simple JSON can be used. Nov 21 '19 at 0:31

To answer your questions:

  1. When it comes to id_token validation, the client needs to verify the integrity and authenticity of the token header and payload by checking the token signature. Yes, the frontend needs to have either client_secret, or public_key of the identity provider. Where it gets it from is implementation-specific, but it can be either embedded inside the client, or the client should download it from the trusted source. The full step-by-step guide of token validation using OpenID Connect is described here: https://connect2id.com/blog/how-to-validate-an-openid-connect-id-token

  2. You still need the session cookie/token. id_token and session_token serve different purposes and have a different life span. Session token has a shorter life span and had to be refreshed regularly (unless the auth timeout is disabled, which is a questionable choice from a security point of view). While identity token usually only gets renewed with the new login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.