107 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Simple Terms OpenID is about verifying a person's identity (authentication). OAuth is about accessing a person's stuff (authorization). OpenID Connect does both. All three let a person give their ...
user avatar
  • 1,413
59 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Many people still visit this so here's a very simple diagram to explain it Courtesy Wikipedia
user avatar
40 votes

When do you use OpenID vs. OpenID Connect

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0. OpenID 2.0 is not OAuth 2.0. OpenID 2.0 and OpenID ...
user avatar
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December ...
user avatar
  • 351
25 votes

Why isn't PKCE encouraged for Single-Page Apps?

While all the other answers are correct, the latest OAuth 2.0 for Browser-Based Apps Best Practices Doc (January 29, 2019) states that (emphasis mine): Overview For authorizing users within a ...
user avatar
21 votes
Accepted

OAuth 2 vs OpenID Connect to secure API

From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, ...
user avatar
19 votes
Accepted

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

tl;dr Most security issues are with implementation and not protocol, the simpler the better. SAML/WS-Federation and OpenID Connect all use cryptographically signed tokens that support optional ...
user avatar
18 votes

Why use OpenID Connect instead of plain OAuth2?

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, ...
user avatar
  • 236
18 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
user avatar
  • 1,331
17 votes

Why isn't PKCE encouraged for Single-Page Apps?

SPAs would not benefit from PKCE. PKCE solves a different problem than the one you're describing. First of all, for SPAs the current best practice is still to use the implicit flow, not the ...
user avatar
  • 694
12 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

We already have a diagram and a lot of good data so here is an example in case that helps. Let's say I want to post a comment to StackOverflow. StackOverflow only allows comments if a user has 50 ...
user avatar
  • 221
11 votes

OAuth 2 vs OpenID Connect to secure API

First off, as you probably know, OpenID Connect is just an authentication layer built on top of OAuth2. So regardless of which on you pick, you will need to implement OAuth2 (as the common denominator)...
user avatar
11 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

In addition to the other responses: I think that a lot of confusion comes from inacurrate, or at least unusual use of the terms Authentication and Authorization OpenID Connect 1.0 is marketed as an ...
user avatar
  • 210
11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

The role concept can be used with access tokens in OpenID Connect (Oauth2). Consider that a scope is a request for claims about the user that should be included in the access token. The API ...
user avatar
10 votes

Openid connect nonce replay attack

Reading your question, I believe the confusion stems from where the replay attack is taking place. The nonce prevents replay attacks against the client (your application), not the authorization ...
user avatar
  • 211
8 votes

Why use OpenID Connect instead of plain OAuth2?

OpenID Connect is a profile of OAuth2... defining an architecture that enables a person to authorize an identity provider to release certain user claims to a client (website / mobile application). ...
user avatar
7 votes

Is CORS ever needed during any aspect of OAuth / OpenIDConnect Authentication?

I'm not sure about OpenID, but for OAuth there is no CORS involved for the actual authentication part, though it may be required on the resource server depending on the type of client that is ...
user avatar
  • 713
6 votes

Is 'Bring your own Identity' as the only authentication option a valid practice?

Yes this is a reasonable approach. It is not a zero risk approach. If a user does not already have an OpenID Connect account, or they do not understand the concept, the sign up process becomes more ...
user avatar
  • 32.6k
6 votes
Accepted

Does use of OpenID Connect for login imply Google can impersonate my users?

The verification is not directly performed by you, so in principle yes, Google could fake the identity of any of its users upon authentication. What happens during the authentication is that your ...
user avatar
6 votes
Accepted

If I misuse OAuth 2.0 to do authentication, am I at risk?

The main issue is making sure that you protect against the confused deputy problem. Imagine you are using OAuth to authenticate users within your application. However, an evil developer has their ...
user avatar
6 votes
Accepted

Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim

The jti (JWT ID) is chosen by the authentication server in order to identify a token. As per OpenID Connect, section 9: JWT ID. A unique identifier for the token, which can be used to prevent ...
user avatar
6 votes
Accepted

Is OpenID Connect implicit flow safe to use?

Implicit Flow is now discouraged in favour of Code Flow with PKCE. This is a fairly recent change (in the last year or so), which is why you might see quite a lot of documentation and libraries still ...
user avatar
5 votes

Use OpenId Connect for authentication only

Looks like I found the answer on Access Token: UserInfo Endpoint It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary ...
user avatar
5 votes

Why use OpenID Connect instead of plain OAuth2?

Using OAuth as an authentication method is not recommended, it is explicitly designed as a delegated authorisation method. Facebook was using OAuth as an authentication method, but an enterprising ...
user avatar
5 votes

Is 'Bring your own Identity' as the only authentication option a valid practice?

No, I don't believe it is, though I am focusing on usability purposes more than security purposes which is perhaps not what you're referring to with this question due to where you posted it, but it is ...
user avatar
  • 59
5 votes

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

2020-12 UPDATE There is an OAuth 2.1 draft to get rid of Implicit flow - short summary here. OAuth 2.1 brings together the latest OAuth 2 best practices. TLDR; best to avoid Implicit flow if you can. ...
user avatar
  • 1,722
5 votes

PKCE vs Client Secret

It boils down to whether there is a chance your authorization code might leak. PKCE is about preventing leaked "authorization code"s from being useful. When you ask for an authorization code, PKCE ...
user avatar
  • 151
5 votes
Accepted

OAuth2: Where should I store my refresh token in a stateless application?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a ...
user avatar
4 votes

Is 'Bring your own Identity' as the only authentication option a valid practice?

It would largely depend on your use-case. For instance I think it is acceptable for websites like Plug DJ or Stackexchange to implement OpenID. Often they don't offer any other form of authentication, ...
user avatar
4 votes

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

To summarize: OpenID Connect is a federated identity API that includes a profile and extension of OAuth 2.0 that enables a client (i.e. mobile app or website) to redirect a person to a central ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible