I have an application that stores the
id_token in the localStorage of the browser.
Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this "feels wrong" to me.
Unfortunately I am not familiar enough with OpenID Connect to properly assess the risk. I can see that the application uses several APIs for which it requests access tokens, but I am not sure if and how
id_token has anything to do with that.
Can I leverage the
id_token to obtain an access token or would I need more information (like the client secret) for that?
I just found out that not only does the application store the id_token, but also an access token scoped for 'openid'. From what I understand so far, it should be possible to use this access token to request more info about the user via the
/userinfo endpoint. Correct?