0

When I want to use encrypted request object with OpenID Connect then my OIDC provider must know my client_secret (used in JWT request object encryption). For the server to decrypt this object, that is, it has to store unencrypted client_secret in the database. This seems quite dangerous, is there any way out of this problem, or maybe I get it wrong?

5
  • Request object encryption is not bound to client secret. A separate Content Encryption Key is generated together with symmetric key. datatracker.ietf.org/doc/html/…
    – defalt
    Jul 11 at 14:17
  • I'm not sure if I understand correctly, but after generating the CEK which will be the symmetric key, I will still need to store it. Should I use plain text for this? I think it's a vicious circle.
    – Szyszka947
    Jul 11 at 15:53
  • It's fine to store CEK together with wherever you are storing client secret.
    – defalt
    Jul 12 at 12:16
  • Yes, but only if I understand, CEK will be stored as plaintext?
    – Szyszka947
    Jul 12 at 12:44
  • Security of client secret and CEK is outside the scope of OIDC. You don't have to store them in plain text. It's upto you how you protect credentials of your service. Explore some methods on how to securely store credentials for the service.
    – defalt
    Jul 12 at 13:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.