112 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
Shaun Luttin's user avatar
  • 1,463
47 votes
Accepted

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
theferrit32's user avatar
28 votes
Accepted

Why use OpenID Connect instead of plain OAuth2?

This article is the best explanation I've found after a LOT of searching (h/t to @rickchristie for linking to it in a comment to another answer). Summary Relying on plain OAuth 2.0 for authentication ...
Nathan Wailes's user avatar
28 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
Eran Medan's user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
Brad J's user avatar
  • 351
20 votes
Accepted

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

tl;dr Most security issues are with implementation and not protocol, the simpler the better. SAML/WS-Federation and OpenID Connect all use cryptographically signed tokens that support optional ...
Karl McGuinness's user avatar
18 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
Moshe Katz's user avatar
  • 1,360
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
el_tigro's user avatar
  • 714
15 votes

Openid connect nonce replay attack

Reading your question, I believe the confusion stems from where the replay attack is taking place. The nonce prevents replay attacks against the client (your application), not the authorization ...
benbotto's user avatar
  • 271
13 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
Pace's user avatar
  • 231
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
Geir Emblemsvag's user avatar
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
Guillaume's user avatar
  • 210
9 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code,...
jnnnnn's user avatar
  • 191
9 votes

Why do big sites use cookies and not OpenID connect?

Hmm. I think there's a lot you don't understand, here. Tons of sites do use OAuth (and often OIDC) for initial authentication, StackExchance (optionally) being one of them. To answer the closest ...
CBHacking's user avatar
  • 47.6k
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
Mike Schwartz's user avatar
8 votes
Accepted

Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim

The jti (JWT ID) is chosen by the authentication server in order to identify a token. As per OpenID Connect, section 9: JWT ID. A unique identifier for the token, which can be used to prevent ...
Geir Emblemsvag's user avatar
8 votes
Accepted

Is OpenID Connect implicit flow safe to use?

Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
Shaun Killingbeck's user avatar
7 votes

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
JackW's user avatar
  • 713
7 votes
Accepted

When using PKCE, are the state and nonce parameters still necessary protection from csrf and code injection?

My answer tries to give a short sum up of the most important information, based on Daniel Fett's article "PKCE vs. Nonce: Equivalent or Not?". For a detailed descirption of attacker models ...
katexochen's user avatar
6 votes
Accepted

If I misuse OAuth 2.0 to do authentication, am I at risk?

The main issue is making sure that you protect against the confused deputy problem. Imagine you are using OAuth to authenticate users within your application. However, an evil developer has their ...
SilverlightFox's user avatar
6 votes

Why use OpenID Connect instead of plain OAuth2?

Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method. Facebook was using OAuth as an authentication method, but an enterprising ...
Alex White's user avatar
5 votes

Use OpenId Connect for authentication only

Looks like I found the answer on Access Token: UserInfo Endpoint It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary ...
Man of One Way's user avatar
5 votes

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

2020-12 UPDATE There is an OAuth 2.1 draft to get rid of Implicit flow - short summary here. OAuth 2.1 brings together the latest OAuth 2 best practices. TLDR; best to avoid Implicit flow if you can. ...
HTKLee's user avatar
  • 1,842
5 votes
Accepted

OAuth2: Where should I store my refresh token in a stateless application?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a ...
Jean-Xavier Raynaud's user avatar
4 votes

Purpose of nonce validation in OpenID Connect implicit flow

My current understanding is as follows: The client (a web application running in the user's browser) generates a nonce, puts it into the browser's session storage, and redirects to the authentication ...
meriton's user avatar
  • 1,488
4 votes
Accepted

Any scenario for using both, OpenID Connect and OAuth 2.0?

Short answer is that it is undefined. If you want a library that supports both, ensure it explicitly states it supports both OAuth 2 and OIDC. If you were to draw a Venn diagram, OAuth 2 and OIDC ...
HTKLee's user avatar
  • 1,842
4 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

To summarize: OpenID Connect is a federated identity API that includes a profile and extension of OAuth 2.0 that enables a client (i.e. mobile app or website) to redirect a person to a central ...
Mike Schwartz's user avatar
4 votes

MS Active Directory vs OpenId Connect?

The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences: Clients ...
Mike Ounsworth's user avatar
4 votes
Accepted

OpenIdConnect: Is there an advantage to using code flow over implicit flow with form_post?

I don't see any security advantage of using the authorization code flow in your case (traditional web application). Indeed, form_post is not vulnerable to referrer leaking or browser history leaking. ...
Tangui's user avatar
  • 433
4 votes
Accepted

Why is SAML still used for enterprise SSO instead of OIDC?

I'm not sure this completely explains the enduring popularity of SAML, but it's worth noting that the SAML standard defines at least one scenario that OIDC does not: IDP-initiated authentication. This ...
Steve P's user avatar
  • 418

Only top scored, non community-wiki answers of a minimum length are eligible