What Is OpenID Connect (OIDC)?
OpenID Connect 1.0 — Architectural definition, operational mechanics, real-world examples, security posture, and client-side inspection utilities.
Web Protocols & Security Architecture Research
What Is OpenID Connect (OIDC)?
Supporting Architectural Explanation
While OAuth 2.0 only issues an Access Token intended for an API (answering "What permissions does this app have?"), OpenID Connect introduces a standardized, digitally signed JSON Web Token called an ID Token (answering "Who is the logged-in user?").
By combining standard OAuth token exchange with the `openid` scope, OIDC enables modern Single Sign-On (SSO), standardized discovery endpoints (`/.well-known/openid-configuration`), and consistent userinfo retrieval across all identity providers (Google, Okta, Microsoft, Apple).
Why does OIDC exist?
Standardized universal federated identity, Single Sign-On (SSO), and verifiable ID tokens across the entire internet ecosystem.
Before OIDC, developers attempted to use OAuth 2.0 for user login ("pseudo-authentication"), but because OAuth lacked a standard identity format, every company invented proprietary user endpoints, creating vendor lock-in and security bugs.
Standardized universal federated identity, Single Sign-On (SSO), and verifiable ID tokens across the entire internet ecosystem.
How does OIDC work?
The client requests the `openid` scope during the OAuth flow; the Identity Provider returns both an Access Token (for APIs) and an ID Token (a signed JWT containing verified user claims).
OpenID Scope Request
Client redirects to auth server requesting `scope=openid profile email`.
User Authenticates
User authenticates with password, Passkey, or MFA at the Identity Provider.
ID Token Emission
IdP returns an ID Token (JWT) along with the standard OAuth access token.
Cryptographic Validation
Client validates ID Token signature against IdP’s public keys (`/.well-known/jwks.json`) and extracts user ID.
How is OIDC implemented in code?
{
"iss": "https://accounts.google.com",
"sub": "108294820193849102",
"aud": "my-client-app-id.apps.googleusercontent.com",
"exp": 1791147600,
"iat": 1791144000,
"auth_time": 1791143990,
"nonce": "n-0S6_WzA2Mj",
"email": "developer@curious-techie.com",
"email_verified": true,
"name": "Sarah Connor",
"picture": "https://lh3.googleusercontent.com/a/..."
}Architectural Explanation: The `sub` claim is the globally unique, immutable user ID. `nonce` prevents replay attacks during authentication.
Where is OIDC commonly used?
Employees logging into Slack, Zoom, and Jira using corporate Okta or Azure Active Directory accounts.
Web and mobile applications offering "Sign in with Apple" or "Sign in with Google".
Verifying identity assertions across service boundaries using short-lived cryptographically signed tokens.
What are the advantages and limitations of OIDC?
Core Advantages
Standardized User Identity
ID tokens look and validate identically whether issued by Google, Microsoft, Okta, or custom auth servers.
Automated Discovery
`/.well-known/openid-configuration` advertises endpoints, signing keys, and supported scopes automatically.
Built-in Replay Protection
The `nonce` claim mathematically binds the user session to the specific browser request.
Architectural Limitations
Signature Verification Requirement
Clients must properly fetch and cache JSON Web Key Sets (JWKS) to verify cryptographic signatures.
Can OIDC introduce security vulnerabilities?
Audience Spoofing (aud claim mismatch)
Attacker takes an ID token issued for App A and submits it to App B to log into someone else’s account.
Always verify that the `aud` (audience) claim strictly matches your own application’s `client_id`.
What are common misconceptions about OIDC?
OIDC does not replace OAuth; it is an extension of OAuth 2.0. OIDC IS OAuth 2.0 plus a standardized ID Token.
Frequently Asked Questions About OIDC
Q:What is the difference between an ID Token and an Access Token?
Clients should never send ID tokens to APIs as bearer authorization credentials; ID tokens are consumed by the frontend/client to establish the local session.
12. Related Interactive Tools
Inspect, test, and verify this protocol directly in your browser with 100% private client-side execution:
13. Related Comprehensive Guides
Ecossistema Técnico Relacionado e Próximos Passos
Perguntas Relacionadas
Can a JWT Be Decrypted by Anyone?
Answer: Yes, standard JSON Web Tokens (JWS) are signed, not encrypted. Anyone can decode and inspect the payload without the secret key.
Why Shouldn't You Store JWTs in LocalStorage?
Answer: Storing tokens in localStorage exposes them to instant exfiltration by any Cross-Site Scripting (XSS) vulnerability.
Can an Expired JWT Token Still Be Verified?
Answer: Yes, the cryptographic signature remains mathematically valid, but compliant libraries reject the token because exp is checked after signature verification.
Laboratórios Práticos de Diagnóstico
Especificações e Referências para Desenvolvedores
Continuar Aprendendo
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.