Check ID Endpoint
The Check ID Endpoint exists to validate the id_token
returned along with the OAuth 2.0
access_token
by ensuring that it was
intended for the correct client and is used by the client to begin an
authenticated session. As described above, this check is required for the
implicit flow for client-side applications (described in Chapter 3). If this check isn’t done correctly, the client
becomes vulnerable to replay attacks.
Here’s an example Check ID endpoint request:
https://accounts.example.com/oauth2/tokeninfo? id_token=eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwiY...
And the response:
{ "iss" : "https://accounts.example.com", "user_id" : "113487456102835830811", "aud" : "753560681145-2ik2j3snsvbs80ijdi8.apps.googleusercontent.com", "exp" : 1311281970 "nonce" : 53f2495d7b435ac571 }
If the response is returned without a standard OAuth 2.0 error, the following checks need to be performed:
Verify the
aud
value in the response is identical to theclient_id
used in the Authorization request.Verify that the
nonce
value in the response matches the value used in the Authorization request.
If this verification is completed successfully, the user_id
is known to represent the unique
identifier for the authenticated user, within the scope of the issuer
(iss
). If storing the identifier in a user database table and multiple identity providers are supported by your application, it is recommended that both values be stored upon account creation and queried upon each subsequent ...
Get Getting Started with OAuth 2.0 now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.