Skip to main content
116 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,503
48 votes
Accepted

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
theferrit32's user avatar
29 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
Eran Medan's user avatar
28 votes
Accepted

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
Brad J's user avatar
  • 351
20 votes
Accepted

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

tl;dr Most security issues are with implementation and not protocol, the simpler the better. SAML/WS-Federation and OpenID Connect all use cryptographically signed tokens that support optional ...
Karl McGuinness's user avatar
19 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
Moshe Katz's user avatar
  • 1,370
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
el_tigro's user avatar
  • 704
15 votes

Openid connect nonce replay attack

Reading your question, I believe the confusion stems from where the replay attack is taking place. The nonce prevents replay attacks against the client (your application), not the authorization ...
benbotto's user avatar
  • 271
14 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
Pace's user avatar
  • 241
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
Guillaume's user avatar
  • 220
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
Geir Emblemsvag's user avatar
11 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 49.5k
10 votes
Accepted

Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim

The jti (JWT ID) is chosen by the authentication server in order to identify a token. As per OpenID Connect, section 9: JWT ID. A unique identifier for the token, which can be used to prevent ...
Geir Emblemsvag's user avatar
9 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
jnnnnn's user avatar
  • 191
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
Mike Schwartz's user avatar
8 votes
Accepted

Is OpenID Connect implicit flow safe to use?

Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
Shaun Killingbeck's user avatar
7 votes

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
JackW's user avatar
  • 713
7 votes
Accepted

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

My answer tries to give a short sum up of the most important information, based on Daniel Fett's article "PKCE vs. Nonce: Equivalent or Not?". For a detailed descirption of attacker models ...
katexochen's user avatar
6 votes
Accepted

If I misuse OAuth 2.0 to do authentication, am I at risk?

The main issue is making sure that you protect against the confused deputy problem. Imagine you are using OAuth to authenticate users within your application. However, an evil developer has their ...
SilverlightFox's user avatar
5 votes

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

2020-12 UPDATE There is an OAuth 2.1 draft to get rid of Implicit flow - short summary here. OAuth 2.1 brings together the latest OAuth 2 best practices. TLDR; best to avoid Implicit flow if you can. ...
HTKLee's user avatar
  • 1,852
5 votes
Accepted

OpenIdConnect: Is there an advantage to using code flow over implicit flow with form_post?

I don't see any security advantage of using the authorization code flow in your case (traditional web application). Indeed, form_post is not vulnerable to referrer leaking or browser history leaking. ...
Tangui's user avatar
  • 443
5 votes
Accepted

OAuth2: Where should I store my refresh token in a stateless application?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a ...
Jean-Xavier Raynaud's user avatar
5 votes
Accepted

Why is SAML still used for enterprise SSO instead of OIDC?

I'm not sure this completely explains the enduring popularity of SAML, but it's worth noting that the SAML standard defines at least one scenario that OIDC does not: IDP-initiated authentication. This ...
Steve P's user avatar
  • 442
4 votes
Accepted

Any scenario for using both, OpenID Connect and OAuth 2.0?

Short answer is that it is undefined. If you want a library that supports both, ensure it explicitly states it supports both OAuth 2 and OIDC. If you were to draw a Venn diagram, OAuth 2 and OIDC ...
HTKLee's user avatar
  • 1,852
4 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

To summarize: OpenID Connect is a federated identity API that includes a profile and extension of OAuth 2.0 that enables a client (i.e. mobile app or website) to redirect a person to a central ...
Mike Schwartz's user avatar
4 votes

MS Active Directory vs OpenId Connect?

The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences: Clients ...
Mike Ounsworth's user avatar
4 votes
Accepted

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

From OIDC back-channel logout draft 06: 2.7. Back-Channel Logout Actions Refresh tokens issued without the offline_access property to a session being logged out SHOULD be revoked. Refresh tokens ...
identigral's user avatar
3 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

As mentioned already, Oauth is one thing, OpenID is another, and OpenID Connect combines the two. But, as mentioned already, the use of authentication and authorization to differentiate Oauth and ...
johnaweber's user avatar
3 votes

What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC?

With the redirect response mode there are more opportunities for the access token to be leaked and it could be said that there's more responsibilities for the client application in order to do it ...
João Angelo's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible