107
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Simple Terms
OpenID is about verifying a person's identity (authentication).
OAuth is about accessing a person's stuff (authorization).
OpenID Connect does both.
All three let a person give their ...
- 1,413
59
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Many people still visit this so here's a very simple diagram to explain it
Courtesy Wikipedia
- 709
40
votes
When do you use OpenID vs. OpenID Connect
I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0.
OpenID 2.0 and OpenID ...
- 501
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
- 351
25
votes
Why isn't PKCE encouraged for Single-Page Apps?
While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine):
Overview
For authorizing users within a ...
- 801
21
votes
Accepted
OAuth 2 vs OpenID Connect to secure API
From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, ...
- 769
19
votes
Accepted
Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?
tl;dr
Most security issues are with implementation and not protocol, the
simpler the better.
SAML/WS-Federation and OpenID Connect all use
cryptographically signed tokens that support optional ...
- 306
18
votes
Why use OpenID Connect instead of plain OAuth2?
OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated.
Technically, ...
- 236
18
votes
OIDC Flow for SPA and RESTful API
Here is the difference between Implicit Flow and AuthCode Flow:
Implicit Flow
NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
- 1,331
17
votes
Why isn't PKCE encouraged for Single-Page Apps?
SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing.
First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
- 694
12
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
We already have a diagram and a lot of good data so here is an example in case that helps.
Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
- 221
11
votes
OAuth 2 vs OpenID Connect to secure API
First off, as you probably know, OpenID Connect is just an authentication layer built on top of OAuth2. So regardless of which on you pick, you will need to implement OAuth2 (as the common denominator)...
- 241
11
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization
OpenID Connect 1.0 is marketed as an ...
- 210
11
votes
How to do role-based authorization with OAuth2 / OpenID Connect?
The role concept can be used with access tokens in OpenID Connect (Oauth2).
Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
- 1,579
10
votes
Openid connect nonce replay attack
Reading your question, I believe the confusion stems from where the replay attack is taking place. The nonce prevents replay attacks against the client (your application), not the authorization ...
- 211
8
votes
Why use OpenID Connect instead of plain OAuth2?
OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application).
...
- 261
7
votes
Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?
I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
- 713
6
votes
Is 'Bring your own Identity' as the only authentication option a valid practice?
Yes this is a reasonable approach.
It is not a zero risk approach. If a user does not already have an OpenID Connect account, or they do not understand the concept, the sign up process becomes more ...
- 32.6k
6
votes
Accepted
Does use of OpenID Connect for login imply Google can impersonate my users?
The verification is not directly performed by you, so in principle yes, Google could fake the identity of any of its users upon authentication.
What happens during the authentication is that your ...
6
votes
Accepted
If I misuse OAuth 2.0 to do authentication, am I at risk?
The main issue is making sure that you protect against the confused deputy problem.
Imagine you are using OAuth to authenticate users within your application.
However, an evil developer has their ...
- 33.2k
6
votes
Accepted
Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim
The jti (JWT ID) is chosen by the authentication server in order to identify a token. As per OpenID Connect, section 9:
JWT ID. A unique identifier for the token, which can be used to prevent ...
- 1,579
6
votes
Accepted
Is OpenID Connect implicit flow safe to use?
Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
5
votes
Use OpenId Connect for authentication only
Looks like I found the answer on Access Token:
UserInfo Endpoint
It should be noted that clients are not required to use the access
token, since the ID Token contains all the necessary ...
- 221
5
votes
Why use OpenID Connect instead of plain OAuth2?
Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method.
Facebook was using OAuth as an authentication method, but an enterprising ...
- 201
5
votes
Is 'Bring your own Identity' as the only authentication option a valid practice?
No, I don't believe it is, though I am focusing on usability purposes more than security purposes which is perhaps not what you're referring to with this question due to where you posted it, but it is ...
- 59
5
votes
Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?
2020-12 UPDATE
There is an OAuth 2.1 draft to get rid of Implicit flow - short summary here. OAuth 2.1 brings together the latest OAuth 2 best practices.
TLDR; best to avoid Implicit flow if you can.
...
- 1,722
5
votes
PKCE vs Client Secret
It boils down to whether there is a chance your authorization code might leak.
PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code, PKCE ...
- 151
5
votes
Accepted
OAuth2: Where should I store my refresh token in a stateless application?
Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a ...
4
votes
Is 'Bring your own Identity' as the only authentication option a valid practice?
It would largely depend on your use-case. For instance I think it is acceptable for websites like Plug DJ or Stackexchange to implement OpenID. Often they don't offer any other form of authentication, ...
- 54.1k
4
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
To summarize: OpenID Connect is a federated identity API that includes a profile and extension of OAuth 2.0 that enables a client (i.e. mobile app or website) to redirect a person to a central ...
- 261
Only top scored, non community-wiki answers of a minimum length are eligible