2

In the OpenID Connect "authorisation-code flow" what security vulnerability is exposed, if the application relies on claims in the ID Token without validating that token?

For example, Google suggests that validating the token is unnecessary in this flow:

Normally, it is critical that you validate an ID token before you use it, but since you are communicating directly with Google over an intermediary-free HTTPS channel and using your client secret to authenticate yourself to Google, you can be confident that the token you receive really comes from Google and is valid.

1 Answer 1

1

The answer to this is a bit later in the same reference you've linked too. To cite:

3.1.3.7. ID Token Validation
Clients MUST validate the ID Token in the Token Response in the following manner:
...
6. If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature.

Note that this simplified validation concerns only the signature check of the specific ID token directly received from a token endpoint which was accessed by TLS and properly authenticated, i.e. the communication was safe against MITM or server impersonation.

6
  • Does the client application still need to check the token's claims concerning the issuer, audience, expiry, and nonce, even if it can skip the check of the signature?
    – benjimin
    Commented Dec 9, 2023 at 11:53
  • @benjimin: the part in the specification explicitly says that how the token MUST be validated and based on what is described there the ONLY part which can be omitted is the signature validation in this scenario. Commented Dec 9, 2023 at 13:34
  • What vulnerability do those claim checks protect against? (Note an industry major player suggests they are superfluous given you trust the identity provider.)
    – benjimin
    Commented Dec 9, 2023 at 22:40
  • @benjimin: Bugs in the server, like getting a different ID token than requested or getting it with unexpected claims etc. Also, making sure that the token is not expired etc Commented Dec 9, 2023 at 23:10
  • Isn't OIDC premised on trusting the identity provider won't produce the wrong token etc?
    – benjimin
    Commented Dec 10, 2023 at 0:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .