Collaborate Disseminate
I understand the different purposes the two parameters serve, but is there anything speaking against the state and nonce parameters being the same string?
Continue reading Can the state and nonce have the same value?
Context
I’m designing a P2P network with a central Discovery Service (providing core info about every platform in the network) but no centralised Auth server.
OAuth 2.0 and OpenID Connect will be used for authorisation between platforms in… Continue reading Discovery Service as a Trust Anchor for P2P Network?
I came across this article. In there the author suggests to use PKCE which is recommended by RFC 8252. But what I am a little bit confused about that the author also uses an application server that has the client_secret.
Are both client_se… Continue reading OIDC for mobile app with PKCE and client_secret
This may be just an academic question, but I have been wondering about something, OK so for this purpose all we care about is AuthN, not AuthZ. Also, there are no users at all, just daemon-to-daemon communications.
So of course we’re all … Continue reading OIDC identity token authentication using JWKS instead of token_introspection
We have a situation of the session_state param on an OpenID Connect/Oauth app is sent on GET. We asked the developers to send it on POST. Developers claim that because standard OIDC/OAuth use 302 redirects, GET is the only option and they … Continue reading Can OpenID session_state be sent on POST?
We are integrating our application with SSO using Entra ID App Registrations and configuring OIDC.
When our application receives the ID token from Microsoft Entra, the iap and exp values seem invalid. This has been occurring for a few mon… Continue reading Entra ID issuing expired ID Tokens
In the OpenID Connect "authorisation-code flow" what security vulnerability is exposed, if the application relies on claims in the ID Token without validating that token?
For example, Google suggests that validating the token is … Continue reading Does an OIDC ID Token need validation in authorization-code flow?
I would like to initialise a React application with an OIDC token.
This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and it will automatically add the OIDC toke… Continue reading Is it safe to store the OIDC token in a private field of a javascript object?
We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it’s commonly called:
GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&response_type=code&tenantId={tenantId}&u… Continue reading Man in the Middle Attack for OAuth 2’s Authorize endpoint
I have a non-browser client (Desktop app) that makes HTTP requests to my API.
I have the desktop client configured to use RFC-8252 (spawn an ephemeral HTTP server to handle the auth code flow’s HTTP redirect) so that the user enters creden… Continue reading Should I use separate OIDC clients for RFC-8252 (OIDC w/ PKCE) client and my HTTP API?