If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?

  • 3
    OAuth2 is used for authorization and OIDC is built on top of Oauth2 for authentication. Their security is equivalent.
    – defalt
    Jun 21 at 19:55


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.