I am currently adding single sign-on functionality between my application and an electronic health record (EHR) system. The SSO is done using the OpenID Connect authorization code flow, but unlike a typical OIDC sign-in (i.e. signing in with Google/Facebook/etc), the EHR system initiates the SSO process (IdP-initiated). Basically, the user will press a button in the EHR, and the expectation is that they are then automatically logged in to my application (which is displayed in a browser frame within the EHR client).
Presently, I am using a JS library (https://github.com/smart-on-fhir/client-js), running in the browser, which manages the OIDC authorization code flow. I have everything working great through the browser and am able to ultimately retrieve an OIDC ID token.
Once I have the ID token, I need to be able to use it as a means of matching to a specific user in my system. To do this, I'll need to pass the token to my application's back-end API, so that the token can be validated and then used to extract the info necessary to find/create a user and log them in.
Are there any security concerns or considerations in regards to passing the OIDC ID token from the browser to my application's API?
FYI, I do have functionality in place to validate ID tokens per OIDC specs, using the rotating, asymmetric, keys that are provided by the EHR's authorization server.