How verify id_token from the browser in OAuth2?

Question

I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused.

I do understand that during the code exchange for an access token the user receives an access_token and on top of that also an id_token. The ID token has personal information like email and username amongst other things.

My main questions

1. How will the browser be able to verify the ID token? Will the frontend need to be shared the signature key ahead of time?
2. Does having the id_token mean that session cookies become obsolete in the application? Is it safe to treat them as the same?

Answer 1

To answer your questions:

1. When it comes to id_token validation, the client needs to verify the integrity and authenticity of the token header and payload by checking the token signature. Yes, the frontend needs to have either client_secret, or public_key of the identity provider. Where it gets it from is implementation-specific, but it can be either embedded inside the client, or the client should download it from the trusted source. The full step-by-step guide of token validation using OpenID Connect is described here: https://connect2id.com/blog/how-to-validate-an-openid-connect-id-token

2. You still need the session cookie/token. id_token and session_token serve different purposes and have a different life span. Session token has a shorter life span and had to be refreshed regularly (unless the auth timeout is disabled, which is a questionable choice from a security point of view). While identity token usually only gets renewed with the new login.