OIDC
acronymsecurityweb dev
Stands for: OpenID Connect
An identity layer on top of OAuth 2.0 for authenticating users.
OpenID Connect adds authentication to the OAuth 2.0 authorization framework, issuing signed ID tokens (JWTs) so an application can verify who a user is. It is the modern successor to much of what SAML did for web single sign-on.
OIDC exists because OAuth deliberately did not answer the identity question, and everyone needed it answered. It is a thin layer on top: the same flows, the same endpoints, plus an ID token that actually asserts who the user is and a standard userinfo endpoint for the rest.
The distinction worth holding is between the two tokens you receive. The access token is for calling APIs and your application should treat it as opaque. The ID token is for your application, is always a JWT, and contains claims about the authenticated user. Sending an ID token to an API, or trusting an access token as proof of identity, is a common and consequential mix-up.
Validation is not optional decoration. The issuer must match the provider you trust, the audience must be your client, the signature must verify against the provider's published keys, the expiry must be current, and the nonce must match the one you sent so a replayed token from another session is rejected. Skip any of these and you have single sign-on that signs anyone in.
Also known as: oidc