I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.
I do understand that during the code exchange for an access token the user receives an
access_token and on top of that also an
id_token. The ID token has personal information like email and username amongst other things.
My main questions
- How will the browser be able to verify the ID token? Will the frontend need to be shared the signature key ahead of time?
- Does having the
id_tokenmean that session cookies become obsolete in the application? Is it safe to treat them as the same?