Skip to main content

New answers tagged

0 votes

Is passing claims about the user in an access token "abusing" OpenID Connect?

Yes it's an abuse. In OIDC, claims about the user can be obtained by the client in two ways: The ID token (which is a JWT). The userinfo JSON endpoint (by exchanging the OAuth access token). The ...
benjimin's user avatar
  • 155

Top 50 recent answers are included