What to read when you want to build OpenID Connect
OpenID Connect has many components. Sometimes, it seems confusing what to read for a new reader, or worse, intimidating.
Here is a flow chart I created as a guide to a new reader. Hope this is going to be useful. Suggestions are welcome as well.
OIDC-Specs-Flowchart
Related OpenID Connect
So, ID Token in OpenID connect is audience restricted to the client while the OAuth bearer access token is audience restricted to the protected resource. It is a bearer. It can be used by anybody. It is a common model …
Andreas Åkre Solberg and Roland Hedberg from Fedlab opened a technology preview of the OpenID Connect Test Facility. It is publicly available now. Start right away to test your OpenID Connect Provider: http://openidtest.uninett.no/ This is an early preview of a …
In OpenID Connect, there are notions of “scopes” and “claims”. Some people see some overlap there and wonders why they are like that. Here is my attempt to explain the relationship between the two. OpenID Connect defined scopes OpenID Connect …
The so called ‘cut and pasted code attack’ also known as ‘Frankenstein Monster Attack’ is an attack that the adversary swaps the ‘code’ in the authorization response with the victim’s ‘code’ that the adversary has gotten hold of somehow. It can …
So, there has been a flurry of worries induced by the CNET and other articles [1] about “Covert Redirect”. Like Leandro Boffi wrote in his blog post [2], this is not a new attack. It is an attack that has been …
